Bundeskartellamt 


6th  Decision  Division 

B6-22/1 6 

ADMINISTRATIVE  PROCEEDINGS 

Decision  under  Section  32(1)  German 
Competition  Act  (GWB) 

-  Public  version  - 


Decision 

In  the  administrative  proceedings 

1.  Facebook  Inc.,  [...],  Menlo  Park,  [...],  U.S.A. 

2.  Facebook  Ireland  Ltd.,  [...],  Dublin,  Ireland, 

3.  Facebook  Deutschland  GmbH,  [...],  Hamburg 

Authorised  representatives  of  1 .  -3.: 


Party  under  1 .  - 


Party  under  2.  - 


Party  under  3.  - 


4.  Verbraucherzentrale  Bundesverband  e.V.,  [...]  Berlin 

-  Third  parties  admitted  to  the  proceedings 
the  6th  Decision  Division  of  the  Bundeskartellamt  has  decided  on  6  February  2019: 
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1.  The  parties  1-3,  including  any  associated  companies  pursuant  to  Section  36(2)  GWB, 
are  prohibited  from  using  terms  of  service  including  specific  provisions  of  data  and 
cookie  policies  and  similar  contractual  terms  which  stipulate  that  the  private  use  by 
users1  residing  in  Germany  of  the  service  available  under  the  web  addresses 
facebook.com  and  facebook.de  and  via  the  mobile  “Facebook”  app  (both  offers 
hereinafter  referred  to  as  Facebook.com)  is  conditional  on  the  following: 

a.  Facebook.com' s  operating  company  can  collect  user  and  device-related  data 
collected  and  saved  from  private  users  residing  in  Germany  when  using 
WhatsApp,  Oculus  and  Masquerade  and  -  without  the  user’s  consent  -  combine 
these  data  with  their  data  collected  and  saved  while  using  Facebook.com  and 
use  the  data; 

b.  Facebook.com' s  operating  company  can  -  without  the  user’s  consent  -  combine 
user  and  device-related  data  collected  from  private  users  residing  in  Germany 
when  using  Instagram  with  their  data  collected  and  saved  while  using 
Facebook.com  and  use  the  combined  data; 

c.  Facebook. corn’s  operating  company  or  a  corporate  provider  of  the  programming 
interfaces  ( Facebook  Business  Tools)  can  -  without  the  user’s  consent  -  collect 
any  user  or  device-related  data  from  users  residing  in  Germany  via  programming 
interfaces  that  are  integrated  into  websites  or  apps  to  create  social  plugins , 
Facebook  Login  and  Account  Kit ,  as  well  as  measurement  and  analysis  services 
based  on  Facebook  Pixel  and  Facebook  SDK,  when  users  use  websites  or 
mobile  apps  by  third-party  providers,  combine  the  data  with  data  collected  in  the 
context  of  the  use  of  Facebook.com  and  use  the  data  ; 

where,  in  particular,  the  first  paragraph  of  section  2  of  the  current  terms  of  service  ("Our 
Data  Policy  and  Your  Privacy  Choices"),  which  contains  provisions  stating  that  personal 
data  is  collected  and  used  to  provide  the  services  and  that  the  user  can  refer  to  the 
data  policy  to  learn  how  his  data  is  collected  and  used,  is  specified  by  the  following 
guidelines: 

the  provision  which  is  currently  section  I  of  the  printable  version  of  the  Facebook 
Data  Policy  (“What  kinds  of  information  do  we  collect?”)  explains  that  the 
collection  of  information  provided  by  the  user,  device-related  information  and 
information  provided  by  partners  applies  to  all  so-called  “Facebook  Products”, 
which  include,  according  to  the  given  definition,  all  products  of  the  Facebook 
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group  including  corporate  services  and  Facebook  Business  Tools,  which  are  used 
by  so-called  “Facebook  Partners”  to  send  information; 

the  provision  currently  contained  in  section  II  of  the  printable  version  of 
Facebook’s  Data  Policy  under  the  headline  “How  do  we  use  this  information?  - 
Provide,  personalize  and  improve  our  Products",  bullet  point  “Information  across 
Facebook  Products  and  devices",  explains  that  the  data  collected  are  used  across 
all  Facebook  Products  for  provision  and  personalisation,  including  information  on 
the  users’  activities  on  various  Facebook  Products  and  devices,  to  provide  the 
user  with  a  tailored  and  consistent  experience  on  all  Facebook  Products  wherever 
they  are  used; 

the  provision  currently  contained  in  section  II  of  Facebook’s  Data  Policy  under  the 
headline  “How  do  we  use  this  information?  Provide  measurement,  analytics,  and 
other  business  services"  explains  that  the  available  information  including  activities 
outside  of  Facebook  Products,  e.g.  websites  visited  and  ads  viewed  is  used  to 
help  advertisers  and  other  partners  measure  the  effectiveness  and  distribution  of 
their  ads  and  services  and  understand  the  types  of  people  who  use  their  services 
and  how  people  interact  with  their  websites,  apps,  and  services; 

the  provision  currently  contained  in  section  II  of  Facebook’s  Data  Policy  under  the 
headline  “Promote  safety,  integrity  and  security',  “Communicate  with  yoU’, 
“Research  and  innovate  for  social  good’  explains  that  the  available  information  is 
used  to  promote  protection,  integrity  and  security,  to  communicate  with  the  user 
and  to  research  and  innovate  for  social  good; 

the  provision  currently  contained  in  section  IV  of  the  printable  version  of 
Facebook’s  Data  Policy  under  the  headline  “How  do  the  Facebook  Companies 
work  together?’  explains  that  information  on  the  user  is  processed  across  the  so- 
called  “Facebook  Companies”  as  permitted  by  applicable  law  and  in  accordance 
with  their  terms  and  policies  to  provide  an  innovative,  relevant,  consistent  and 
safe  experience  across  all  products  provided  by  the  Facebook  Companies,  which, 
pursuant  to  this  provision,  include  Oculus  and  Oculus  Ireland  Ltd.,  WhatsApp  Inc. 
and  WhatsApp  Ireland  Ltd.,  and  Masquerade; 

the  provision  currently  contained  in  Facebook’s  Cookies  Policy  under  the  headline 
“Where  do  we  use  cookies",  which  is  referred  to  in  the  Data  Policy  (“What  kinds 
of  information  do  we  collect  -  Device  Information"),  explains  that  Facebook  places 
cookies  on  the  computers  or  devices  to  receive  information  stored  in  cookies 
when  the  user  uses  or  visits  Facebook  Products,  Products  provided  by  other 
members  of  the  Facebook  Companies  and  websites  and  apps  provided  by  other 
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companies  that  use  the  Facebook  Products  including  Facebook  Business  Tools, 
and  stipulates  that  Facebook  receives  this  information  including  device-related 
information  and  information  on  the  user’s  activities  without  any  further  user  action 
once  the  user  visits  websites  and  apps  meeting  the  criteria  specified  above; 

the  definition  currently  given  in  Facebook’s  Cookies  Policy  under  the  headline 
“Cookies  &  Other  Storage  Technologies ”  extending  the  aforementioned 
provisions  on  the  use  of  cookies  to  other  technologies,  including  the  data  saved 
by  Facebook  on  the  user’s  web  browser  or  device,  identifiers  linked  to  that  device 
and  other  software. 

2.  The  parties  1  -3,  including  any  affiliated  companies  pursuant  to  Section  36(2)  GWB,  are 
prohibited  from  implementing  the  Facebook  terms  of  service  including  the  Facebook 
data  and  cookies  policies  within  the  meaning  of  paras  l.a.  to  c.,  in  particular  as  far  as 
the  following  aspects  are  concerned: 

a.  Collection  of  the  phone  number  indicated  by  private  users  upon  registration  for 
WhatsApp,  their  device  identifications,  operating  system  versions,  app  versions, 
platform  information,  country  code,  network  code,  identifiers  allowing  to  track  the 
user’s  agreement  with  updates  and  control  options  and  information  on  when 
WhatsApp  was  last  used,  information  on  when  the  account  was  registered  and  how 
and  how  frequently  features  were  used,  and  other  user  and  device-related 
information,  and  combination  of  this  information  with  data  collected  and  saved  while 
the  users  were  using  Facebook.com,  e.g.  via  a  family  device  ID  and  matching  the 
information  with  the  users’  Facebook  IDs,  and  use  of  that  information. 

b  Collection  of  the  user  and  device-related  information  of  private  users  of  Oculus  and 
Masquerade,  e.g.  account  information,  content  created,  meta  data,  transaction 
data,  payment  information,  device  information,  device  IDs,  cookie  and  pixel 
information,  information  on  the  use  of  third-party  websites  or  apps  and  location  data 
and  combination  of  this  information  with  data  collected  during  their  use  of 
Facebook.com,  e.g.  via  Facebook  Login,  the  user’s  email  address  or  device  IDs, 
and  matching  this  information  with  their  Facebook  IDs,  and  use  of  that  information. 

c.  The  combination  of  information  and  content  provided  by  private  users  of  Instagram, 
their  networks  and  connections  on  Instagram,  information  on  their  use  of  Instagram, 
transactions  carried  out  on  Instagram,  other  people’s  activities  and  information 
others  provided  on  a  user,  information  on  the  terminal  device  used  for  accessing 
Instagram  including  device  attributes,  processes  on  the  device,  identifiers,  device 
signals,  data  from  the  device  settings,  network  and  connections,  cookie  data  and 
information  provided  by  partners  of  Instagram  with  data  collected  and  stored  during 
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their  use  of  Facebook.com,  e.g.  via  a  family  device  ID  and  matching  this  information 
with  the  users’  Facebook  IDs,  and  use  of  that  information. 

d.  Collection  of  private  users’  device  information,  information  on  websites  visited, 
purchases  made,  advertisements  viewed  and  information  on  usage  collected  via 
Facebook  Business  Tools  which  are  used  by  advertisers,  app  developers  and 
publishers  (“Facebook  Partners”)  via  the  following  APIs, 

-  If  social  plugins  are  integrated  by  Facebook  Partners  to  collect,  in 
particular,  the  IP  address,  the  browser  type,  the  URL,  the  website  visited 
and  the  time  of  visit,  as  well  as  the  user  ID,  which  is  retrieved  from  the 
cookie,  the  website,  date  and  time;  if  an  app  is  integrated  the  collection  of 
information  on  the  app  provider,  the  app  ID,  the  operating  system  used, 
the  device  model,  screen  size,  processor  cores,  total  storage  space,  name 
and  version  of  the  app  used,  the  so-called  “User-Agent-String”  (browser 
information),  IP  address,  time  zone  and  the  corresponding  “SDK  events”. 

-  If  Facebook  Login  and  Account  Kit  are  integrated  by  Facebook  Partners 
to  collect  the  same  amount  of  data  as  with  social  plugins  for  websites  and 
mobile  apps  plus,  in  particular,  login  information  the  users  enter  manually, 
as  well  as  error  messages  containing  the  user  ID. 

-  If  pixel  and  SDK-based  measurement  and  analysis  services  are  integrated 
by  Facebook  Partners  to  collect,  in  particular,  the  http  header’s  data  set, 
IP  addresses,  browser  information,  site  storage  location,  document 
information,  referrer  (website  via  which  the  user  accessed  the  current 
website),  information  on  the  user,  pixel-specific  data  like  the  pixel  ID  and 
the  Facebook  cookie,  click  data  and  configured  “events”,  device 
information  including  the  advertising  ID,  cookie  data  and  hashed  user 
identifiers 

and  its  combination  with  data  collected  and  saved  while  these  users  were  using 
Facebook.com,  e.g.  via  cookie  data,  device  IDs,  a  comparison  of  further  device- 
related  data,  hashed  user  IDs  in  the  context  of  “advanced  matching”  by  matching 
this  information  with  the  Facebook  ID,  and  its  use. 


3.  The  parties  1  -3,  including  any  affiliated  companies  pursuant  to  Section  36(2)  GWB,  are 
obliged  to  implement  the  following  remedies  to  terminate  the  conduct  prohibited  in 
paragraphs  1  and  2: 
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a.  Terminate  or  adjust  the  contractual  terms  prohibited  in  paragraph  1  and  the 
implementation  of  contractual  terms  prohibited  in  paragraph  2  within  12  (twelve) 
months. 

b.  Within  12  (twelve)  months  after  the  date  of  enforceability  of  the  decision,  when 
adjusting  the  terms  and  conditions,  also  in  the  Facebook  terms  of  service  and  data 
policies  or  similar  documents  specifying  them,  expressly  clarify  the  following: 

-  Collection  of  private  and  device-related  user  data  from  WhatsApp,  Oculus 
and  Masquerade  and  combination  with  data  collected  and  stored  from 
their  use  of  Facebook  is  subject  to  the  user’s  consent  and  will  not  take 
place  without  it. 

-  Collection  of  private  and  device-related  user  data  from  Instagram  and 
combination  with  data  collected  and  stored  from  their  use  of  Facebook  and 
use  for  Facebook.com  is  subject  to  the  user’s  consent  and  will  not  take 
place  without  it. 

-  Collection  of  private  user  and  device-related  data  from  websites  or  mobile 
apps  via  Facebook  Business  Tools  and  combination  with  the  data 
collected  and  stored  from  their  use  of  Facebook  and  use  for 
Facebook.com  is  subject  to  the  user’s  consent  and  will  not  take  place 
without  it. 

c.  Present  within  4  (four)  months  an  implementation  plan  detailing  which  measures 
the  parties  intend  to  take  to  fulfil  the  obligations  under  paragraph  3  and  in  which 
steps  and  at  which  points  in  time  these  measures  will  be  implemented. 

4.  Users  are  not  deemed  to  have  given  their  consent  within  the  meaning  of  paragraphs  1 
to  3  if  the  provision  of  the  Facebook.com  service  is  conditional  on  the  users'  consent 
to  the  collection  and  combination  of  data. 

5.  If  a  request  to  restore  the  suspensive  effect  of  the  appeal  pursuant  to  Section  65(3) 
sentence  3  GWB  is  filed  within  a  period  of  2  (two)  months  upon  receipt  of  the  decision, 
the  deadlines  for  implementation  stipulated  in  paragraphs  3. a.  to  c.  are  extended  once 
by  2  months.  The  suspension  begins  upon  receipt  of  the  request  by  the  appeal  court 
and  ends  upon  termination  of  the  expedited  proceedings  on  this  request  at  first 
instance. 

6.  The  administrative  fee  for  the  proceedings,  including  this  decision,  amounts  to  [. . .]  and 
is  payable  by  the  parties  to  the  proceedings. 

7.  The  Bundeskartellamt  reserves  the  right  to  revoke  paragraphs  1  to  6  of  this  decision  in 
full  or  in  part. 
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Reasons: 


A.  Statement  of  facts 
I.  Facebook 

1 .  The  Facebook  group 

1  The  Facebook  group  develops  and  operates  various  digital  products,  online  services 
and  applications  for  smartphones  (hereinafter:  apps).  Facebook’s  parent  company  is 
Facebook  Inc.,  which  is  headquartered  in  Menlo  Park/USA.  Hamburg-based  Facebook 
Germany  GmbH  and  Dublin-based  Facebook  Ireland  Ltd.  are  wholly-owned 
subsidiaries  of  Facebook  Inc.  (all  companies  together  are  hereinafter  referred  to  as 
Facebook). 

2  Facebook  Inc.  is  owned  by  a  large  number  of  different  investors.  The  largest  share 
(28%)  is  held  by  the  company's  co-founder  and  chairman  of  the  Board  of  Directors, 
Mark  Zuckerberg.  Further  shareholders  are  Facebook  co-founders  Dustin  Moskovitz 
and  Eduardo  Saverin.  Facebook  employees  hold  another  large  part  of  (free  float) 
shares.  The  remaining  shares  are  also  held  by  a  large  number  of  investors. 

3  The  company’s  products  include  the  “Facebook”  service,  which  was  developed  by  Mark 
Zuckerberg  and  is  financed  through  advertising.  It  comprises  the  “Facebook 
Messenger”  communication  service  and  other  products  offered  under 
www.facebook.com  (also  accessible  in  Germany  via  www.facebook.de,  which  forwards 
the  query  to  www.facebook.com).  The  service  is  hereinafter  referred  to  as 
Facebook.com,  which  is  specified  under  2.  According  to  the  impressum,  the 
European  provider  of  the  Facebook.com  services  is  Facebook  Ireland  Ltd.2 

4  Besides  Facebook.com,  Facebook  also  offers  the  Instagram  service,  which  was 
previously  operated  by  the  separate  group  Instagram  Inc.,  San  Francisco/USA.3 
Facebook  acquired  Instagram  Inc.  in  2012.  Since  25  May  2018  Instagram  has  been 
operated  by  Facebook  Ireland  Ltd.  too.  Instagram  is  a  mostly  mobile  service  for  sharing 
photos  and  videos  (see  details  under  3.). 

5  The  business  purpose  of  Facebook  Germany  GmbH  is  to  support  Facebook  Ireland 
Ltd.  in  the  areas  of  advertising,  communications  and  public  relations  work.4  Facebook 


2  https://www.facebook.com/leaal/terms?ref=pf .  [...] 

3  [■■■] 

4  Excerpt  from  the  German  register  of  companies,  ref.  HRB  111  963:  “The  purpose  of  this  company  is  to  support 
the  online  network  platform  Facebook  by  providing  any  type  of  services  in  the  areas  of  sales,  marketing, 
commercial  development,  technology  research  and  development,  public  relations  and  communications  as  well 
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Payments  Inc.,  Menlo  Park/USA5,  which  supports  payments  made  in  various  Facebook 
services,  is  part  of  the  Facebook  group  too. 

6  In  addition  to  that,  the  Facebook  group  owns  further  subsidiaries,  which  also  offer 
online  services  and  apps: 

7  First  of  all,  WhatsApp  Inc.,  Menlo  Park/USA  offers  the  “WhatsApp”  mobile  app  via  its 
Irish  subsidiary  WhatsApp  Ireland  Ltd.,  Dublin.  The  WhatsApp  communication  service 
was  launched  in  2010  and  acquired  by  Facebook  Inc.  in  2014.  WhatsApp  users  can 
exchange  text  messages,  pictures,  videos,  audio  files,  locations,  documents  and 
contacts,  both  between  individual  users  and  in  groups  (see  details  under  4  below). 

8  In  2016  Facebook  acquired  Minsk-based  Masquerade  Technologies  Inc.,  which 
offers  the  “Masquerade”  (MSQRD)  app  for  editing  and  sharing  pictures  with  filters  and 
masks.  Masquerade  is  used  by  [...]  people  in  Germany  each  month.6 

9  Facebook  T echnologies  LLC  (formerly  Oculus  VR,  LLC),  Menlo  Park/USA7  specialises 
in  developing  “Virtual  Reality”  headsets.  It  manufactures  the  hardware  required  for 
virtual  reality  products  like  the  VR  headsets  Rift  and  Gear  VR  and  operates  a  platform 
for  users  to  upload  or  download  contents  like  virtual  reality  games.  In  Europe  these 
products  are  provided  by  Facebook  Technologies  Ireland  Ltd.  [...]  people  in  Germany 
use  Oculus  Rift  and  Oculus  Gear  each  month.8 

1 0  Facebook  Inc.  has  owned  the  Israeli  company  Onavo  Inc.9  since  201 3.  The  latter  offers 
mobile  apps  optimising  the  use  of  memory  and  data  plans  (“Onavo  Extend”)  by 
identifying  the  apps  which  require  the  largest  data  volume,  and  mobile  apps  to  protect 
private  data  when  using  public  WiFi  networks  (“Onavo  Protect”,  hereinafter:  Onavo). 
The  company  also  offers  “Onavo  Insights”,  which  provides  companies  with  analytical 
data  on  the  use  of  apps  and  consumer  trends  in  the  areas  of  online  gaming,  social 
networks,  finances  and  entertainment. 

1 1  Facebook  Inc.  acquired  the  analysis  service  CrowdTangle  Inc.  in  2016.  Among  other 
things,  the  service  shows  companies  how  to  spread  their  content  online  and  how  such 
content  becomes  “viral”.10 


as  any  other  commercial,  administrative  or  IT-related  service  to  the  Facebook  group11  (Bundeskartellamt 
unofficial  translation,  original  version  accessed  on  21  March  2017,  [...]. 

5  cf.  https://www.facebook.com/payments_terms/privacy  Version:  30  December  2013,  [...] 

6  [■■■] 

7  https://www.oculus.com/ :  [...1 

8  [■■■] 

9  Cf.  http://www.onavo.com/privacv  policy/  ,  Version  of  14  December  201 8, [...];  the  data  policy  having  been 
modified,  data  processing  from  this  service  is  no  longer  subject  of  the  proceedings. 

10  http://www.crowdtangle.com/features.  f...1 
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12  In  2014  Facebook  Inc.  acquired  the  Finnish  company  ProtoGeo  Oy,  which  operated 
the  mobile  fitness  app  Moves  with  a  patented  algorithm.  The  app  created  an  exact 
motion  profile  of  each  user  and  gave  an  overview  of  the  calories  used  and  distances 
covered.  According  to  Facebook’s  statements,  this  app  was  withdrawn  from  the  market 
effective  31  July  201 8. 11 

1 3  The  total  turnover  of  Facebook  Inc.,  98%12  of  which  was  generated  through  advertising, 
amounted  to  approx.  55  billion  US  dollars  in  201 813. 

2.  Facebook.com 

14  Under  the  umbrella  of  Facebook.com,  the  Facebook  group  provides  a  range  of 
products  and  services  addressing  various  groups.14  Its  offers  include  the  social  network 
Facebook,  which  primarily  addresses  private  users  and  publishers  (see  a.).  For 
advertisers  Facebook  offers  various  products  linked  to  the  social  network  and  other 
services  of  the  Facebook  group  (see  b).  In  addition,  Facebook.com  includes  the 
Facebook  developer  platform  (“Facebook  for  Developers”),  which  offers  third-party 
companies  further  software  products  and  programming  interfaces  for  developing  their 
services,  i.a.  via  “Facebook  Business  Tools”  (see  c.). 

a.  Social  network 

15  Facebook’s  core  product  is  its  social  network,  which  can  be  accessed  in  Germany  via 
www.facebook.de  and  www.facebook.com.  Facebook’s  social  network  was  founded  in 
2004  by  a  group  of  students  including  Mark  Zuckerberg.  It  has  been  available  in 
Germany  since  2008. 

16  The  network’s  user  numbers  have  been  rising  continuously  since  its  foundation. 
Facebook  has  various  ways  of  determining  its  user  numbers:  It  indicates  both  its  daily 
active  users  (DAU)  and  its  monthly  active  users  (MAU).  Daily  active  users  are  defined 
as  registered  Facebook  users  logging  on  to  Facebook.com  either  via  the  website  or  a 
mobile  device  to  browse  the  site,  or  as  registered  Facebook  users  using  the  Facebook 
Messenger  App,  on  a  given  day.15  Monthly  active  users  are  defined  as  registered 
Facebook  users  who  in  the  last  30  days  have  logged  on  to  Facebook.com  either  via 


11  https://newsroom.fb.com/news/201 8/07/hello-tbh-movinq-on/ ,  [...] 

12  Facebook,  2017  Annual  Report,  p.  9  (downloadable  from 
https://s21.g4cdn.com/399680738/files/doc  financials/annual  reports/FB  AR  2017  FINAL.pdf,  [...] 

13  Facebook,  Facebook  Reports  Fourth  Quarter  and  Full  Year  201 8  Results  ,  [...] 

14  [■■■] 

[...] 


15 
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the  website  or  a  mobile  device  to  browse  the  site,  or  as  registered  Facebook  users 
using  the  Facebook  Messenger  App.16 

1 7  In  December  201 8  Facebook  had  1 .52  billion  daily  active  users  and  2.32  billion  monthly 
active  users.17  In  November  2018  the  number  of  users  in  Germany  was  still  increasing, 
with  23  million  daily  active  users  and  32  million  monthly  active  users.18 

18  The  network  and  its  various  functions  are  mostly  used  by  private  users  (see  (1).  It  is 
also  used  by  commercial  publishers  (see  (2). 

(1)  Private  user  applications 

19  German  users  can  access  Facebook.com  either  via  their  browsers,  typing  in  the 
address  www.facebook.com  or  www.facebook.de,  or  via  the  Facebook  app  on  their 
mobile  devices.  The  company  does  not  charge  a  monetary  fee  for  using  Facebook.com 
or  downloading  the  app. 

20  Facebook.com  offers  private  users  a  range  of  functions  to  connect  with  their  friends 
and  acquaintances  and  share  contents  with  them.  Facebook  describes  the  key 
functions  of  its  social  network  as  “connect”,  “communicate”,  “share”,  and  “discover”.19 

21  Private  Facebook.com  use  is  subject  to  registration  by  creating  a  user  profile.  Users 
create  their  own  profiles  which  are  the  basis  for  their  personal  Facebook  sites.  Using 
their  real  names,  users  can  enter  information  on  themselves  and  set  a  profile  picture. 
Additionally,  users  can  enter  information  on  their  relationship  status,  current  place  of 
residence,  past  and  present  workplaces,  interests  and  religious  and  political  views. 
Based  on  this  information,  Facebook.com  creates  a  personalised  site  for  each  user, 
which  is  subdivided  into  three  subsites:  the  profile  page,  the  start  page  and  the  “find 
friends”  page. 

22  Besides  the  personal  information  users  enter,  the  profile  page  also  contains  the 
“timeline”,  which  has  been  available  in  Germany  since  2011.  It  lists  and  displays  all 
activities  of  each  user  in  an  inverted  chronological  order  along  a  timeline.  It  also 
contains  a  list  of  “friends”,  i.e.  a  list  of  people  with  their  real  names  and  profile  pictures 
with  whom  the  user  is  connected  in  the  social  network.  Users  can  determine  which  type 
of  information  is  visible  for  whom. 


17  Facebook,  Facebook  Reports  Fourth  Quarter  and  Full  Year  201 8  Results  ,  [...] 

18  https://allfacebook.de/zahlen_fakten/offiziell-facebook-nutzerzahlen-deutschland  (in  German,  last  accessed  on 
10  January  2019);  [...] 

[■■■] 
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23  The  “find  friends”  page  allows  users  to  find  people  by  applying  targeted  search 
parameters  (name,  place  of  residence,  school,  employer).  Facebook.com  also  applies 
an  algorithm  to  suggest  people  the  user  probably  knows  as  potential  new  “friends”. 
Users  can  also  upload  their  e-mail  directories  or  the  contact  lists  on  their  smartphones 
to  find  registered  Facebook  users.  To  connect  with  other  Facebook  users,  they  have  to 
send  a  friendship  request  which  the  respective  user  can  accept  or  decline. 

24  Users  can  also  found  or  join  groups.  Groups  are  networks  which  have  been  set  up  to 
discuss  mutual  interests  or  to  meet  specific  communication  requirements.  Their 
visibility  can  be  restricted  to  members  (secret  groups),  group  membership  can  be 
subject  to  approval  by  a  moderator  and  any  comment  made  in  such  a  group  is  not 
publicly  visible  (closed  groups),  or  they  can  be  open  to  everyone  and  all  comments  are 
public  (open  groups).  Each  group  belongs  to  a  certain  category,  e.g.  hobbies  and 
interests,  sports,  school  and  education,  buy  and  sell,  etc. 

25  The  start  page  is  the  central  communication  area.  It  contains  the  “news  feed”  displaying 
recent  information  (“posts”)  provided  by  the  users’  friends  or  by  publishers  and 
companies  (see  (2)  below)  which  the  user  either  subscribed  to  or  which  he  marked  by 
clicking  on  the  “like”  button.  An  algorithm  sorts  the  posts  in  the  news  feed  by  relevance 
for  each  user  based  on  his  data. 

26  The  users’  own  “status  reports”  are  a  key  feature  of  the  news  feed.  Users  can  choose 
to  share  their  own  posts  with  friends  (and  messenger  contacts)  or  the  general  public. 
Depending  on  their  relevance,  these  posts  then  appear  either  in  the  friends’  news  feeds 
or  across  the  entire  network.  Users  can  share  their  thoughts  and  include,  e.g.,  a  picture, 
a  video  or  their  current  location.  They  can  also  select  an  activity  (e.g.  “feeling”, 
“watching”,  “reading”,  “listening  to”  etc.)  from  a  long  list  and  further  illustrate  their  mood 
by  choosing  from  a  large  variety  of  “emoticons”  (smileys  to  match  their  current  mood). 
Users  can  also  integrate  third-party  content  by  clicking  on  a  “social  plugin”  (e.g.  “Like” 
or  “Share”)  on  external  websites  or  apps.  By  doing  so,  they  create  a  hyperlink  with 
website  preview  in  their  friends’  personal  newsfeed  for  them  to  comment  on  or  share 
with  others. 

27  Users  can  also  communicate  bilaterally  or  in  small  groups  in  real  time  via  the  Facebook 
Messenger  (“chats”  and  “chat  rooms”)  exchanging  text  messages,  photos,  videos  or 
audio  files.  The  Messenger  can  also  be  used  for  voice  and  video  calls.  Since  2011 
Facebook  Messenger  has  been  offered  as  a  messaging  tool  for  Facebook.com  users 
as  part  of  the  social  network.  It  is  a  part  of  the  service  which  is  pre-installed  in  the 
desktop  version  of  the  Facebook  website  and  exclusively  accessible  via 
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Facebook.com.  The  Messenger  has  been  available  as  a  separate  app  for  mobile 
devices  since  201 420,  also  for  users  who  do  not  have  a  Facebook  account. 

28  Since  August  201 7  Facebook  has  also  been  offering  Facebook  Marketplace  as  a  sales 
platform  which  can  be  accessed  via  the  social  network’s  start  page.  Users  can  create 
free  classifieds  to  buy  or  sell  (used)  things.21  Facebook  Marketplace  is  a  supplement 
to  users’  sales  activities  in  the  buy  and  sell  groups  mentioned  above. 

29  Facebook  offers  further  functionalities  through  its  social  network,  e.g.  event 
organisation,  job  search,  weather  forecasts  or  fundraisers.  There  are  plans  to  include 
a  dating  function  and  a  video-on-demand  platform  (Facebook  Watch)  in  future. 
Facebook  Watch  is  already  available  in  the  USA. 

30  Private  users  are  also  offered  a  variety  of  apps  created  by  third-party  providers  on  the 
basis  of  a  developer  platform.  Apps  developed  for  Facebook  by  third-party  providers 
are  available  to  users  of  the  social  network  via  the  “App  Center”.  Such  apps  are  mostly 
games  of  all  kinds  which  can  be  played  as  “Instant  Games”  on  Facebook.com,  some 
of  them  interactively  with  other  users.  There  is  also  a  separate  app,  “Gameroom”,  which 
can  be  installed  on  computers  or  mobile  devices  to  continue  the  game  with  the 
achieved  score  on  several  devices.  A  Facebook  account  is  required  for  using  the  app. 

31  Any  payment  required  by  Facebook.com,  e.g.  in-app  purchases  in  games  or 
fundraisers,  is  to  be  made  with  “Facebook  Payments”.  Facebook  Payments  supports 
various  forms  of  payment  like  credit  or  debit  cards,  Facebook  coupons  or  payments  via 
the  mobile  virtual  network  operator.22  In  return  for  its  services  Facebook  receives  a 
share  of  the  revenues  from  the  providers. 

(2)  Publisher  applications 

32  Facebook  offers  publishers  the  opportunity  to  use  the  social  network  as  a  space  for 
publishing  their  own  contents.  For  this  purpose,  companies,  associations  or  individuals 
can  create  their  own  Facebook  “pages”  free  of  charge.  Publishers  can  spread  their 
contents  on  Facebook,  connect  with  users  through  “subscriptions”  and  “likes”,  and 
increase  their  reach  as  a  result. 

33  Operating  a  Facebook  business  page  is  subject  to  registration  with  either  a  personal 
Facebook  account  or  a  “Business  Manager”  account23.  When  creating  its  site,  a 


20  [...] 

21  https://www.heise.de/newsticker/meldunq/Facebook-Flohmarkt-Marketplace-startet-in-Deutschland- 

3801730.html  (last  accessed  on  1 0  January  201 9). 

22  Cf.  https://www.facebook.com/payments  terms,  f...1 

23  Cf.  https://www.facebook.com/business/learn/how-business-manaaer-works/auide  .  [...] 
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business  can  choose  from  the  categories  “company  or  brand”  and  “community  or  public 
figure”,  each  with  various  subcategories,  and  set  up  its  page  in  a  way  that  is  similar  to 
users’  personal  pages.  By  communicating  on  Facebook.com,  e.g.  by  “sharing”  contents 
with  the  personal  network,  site  contents  can  be  spread. 

34  Users  who  have  subscribed  to  a  business  site  receive  the  contents  published  by  that 
business  in  their  newsfeeds.  Publishers  can  use  “Instant  Articles”  to  host  their  contents 
directly  on  Facebook.com,  making  it  unnecessary  to  redirect  users  to  the  general 
website  Facebook.com  in  order  to  read  an  article  or  watch  a  video.  The  content  is 
therefore  readily  and  quickly  available  to  users,  and  the  users  stay  on  the  Facebook 
platform. 

35  Publishers  can  also  advertise  and  monetise  their  content  by  using  the  Facebook  ads 
manager  for  Facebook.com  or  the  Facebook  Audience  Network  (see  b.  below)  for  their 
websites.  By  integrating  “Facebook  Analytics”  and  using  further  Facebook 
measurement  and  analysis  tools  (see  c.  below),  companies  can  access  the  information 
Facebook  collected  on  user  behaviour  with  regard  to  their  contents24  and  thus  optimise 
their  interactions  and  advertising  activities. 

36  According  to  publicly  available  figures,  approx.  70  million  companies  worldwide  used 
the  Facebook  pages  in  the  fourth  quarter  of  201 7.25 

b.  Online  advertising 

37  Facebook  uses  online  advertising  to  fund  its  social  network.  Advertisements  can  be 
published  on  Facebook.com,  Facebook  Messenger,  Instagram  or  on  third-party 
websites  which  are  part  of  Facebook’s  advertising  network  (the  “Facebook  Audience 
Network”)  via  the  so-called  Audience  Network  SDK.  The  ads  match  a  user’s  individual 
profile.  The  aim  is  to  present  the  user  with  ads  that  are  potentially  interesting  to  him 
based  on  his  personal  commercial  behaviour,  his  interests,  purchasing  power  and  living 
conditions  (“targeting”,  “targeted  advertising”,  “interest-based  advertising”, 
“personalised  advertising”).  In  December  2018  the  “Average  Revenue  per  User” 
(ARPU)  per  quarter  was  1 0.98  US  dollars  in  Europe  and  7.37  US  dollars  worldwide.26 


24  [■■■] 

25  Cf.  https://allfacebook.de/toll/state-of-facebook  ;  figures  relating  to  Germany  are  confidential. 

26  Facebook,  Facebook  Reports  Fourth  Quarter  and  Full  Year  201 8  Results, 

httos://s21  .g4cdn.com/399680738/files/doc  financials/201 8/Q4/Q4-201 8-Earninqs-Presentation.pdf,  [...] 


14 


(1)  Advertising  on  Facebook 

38  Advertising  on  Facebook.com  is  subject  to  registration  with  a  personalised  Facebook 
account  or  a  Business  Manager  account  and  a  Facebook  “page”.  Advertising 
customers  can  create  their  ad  campaign  using  the  “Ads  Manager”.  They  can  specify 
their  advertising  objectives  and  audience. 

39  Via  the  ads  manager  advertisers  can  decide  where  to  place  their  ads  or  rely  on 
Facebook.com  to  place  the  advertisement  automatically  wherever  it  is  most  likely  to 
achieve  the  best  results.27  Advertising  space  is  available  on  Facebook’s  social  network 
and  the  Messenger.  Advertisements  are  displayed  both  in  the  users’  newsfeeds,  where 
they  are  marked  as  “sponsored”,  and  in  the  right  column  of  the  users’  start  page.  If 
requested,  users  can  be  redirected  directly  to  the  online  shop  by  clicking  on  the 
advertisement. 

40  Since  2014  there  have  been  additional  advertising  opportunities  on  Instagram,  and 
further  opportunities  will  be  available  on  WhatsApp  as  of  201 9.28  Advertisements  can 
also  be  spread  via  third-party  websites  and  apps  outside  Facebook  if  they  are 
connected  to  the  Facebook  Audience  Network.  Facebook  acts  as  an  agent  between 
advertisers  and  third-party  websites  or  apps  and  thus  expands  the  Facebook  group’s 
scope  of  advertising  with  this  network.  Facebook’s  agency  services  are  subject  to  a 
commission  paid  by  the  advertisers. 

41  Further  advertising  space  is  available  in  the  form  of  instant  articles  and  in-stream 
videos  displaying  advertisements  when  users  view  media  contents.29  In  addition  to 
that,  Facebook  App  Ads  gives  mobile  app  providers  the  opportunity  to  advertise  their 
apps  on  Facebook.com,  Instagram  or  the  Facebook  Audience  Network.  The 
advertisement  contains  a  direct  link  to  Apple’s  app  store,  Google’s  PlayStore  or 
Kindle’s  Fire  Store,  where  the  mobile  app  can  be  downloaded.  App  Ads  can  also  be 
used  to  once  again  specifically  contact  those  users  who  have  already  downloaded  an 
app  to  entice  them  to  carry  out  further  activities  in  the  app.30 

42  Advertisers  can  set  the  budget  and  timeline  for  their  campaigns  and  create  their 
contents  by  selecting  a  format,  uploading  photos  and  deciding  on  the  content.  The 
decision  of  which  advertising  space  to  allocate  to  whom  is  made  in  an  auction 


28  https://www.heise.de/newsticker/meldunq/Werbunq-bei-WhatsApp-Jetzt-wird-Geld-verdient-4128652.html ,  in 

German,  last  accessed  on  1 0  January  201 9). 

29  see  information  provided  by  Facebook  in  its  advertising  manager  under  “Placements  for  an  Ad’’. 

30  https://de-de.facebook.com/business/learn/facebook-create-ad-app-install-enqaqement.  f. .  .1 
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process.31  Advertising  products  are  paid  for  based  on  “cost  per  click”,  “cost  per  action” 
or  “cost  per  thousand  impressions  (CPM)”.32 

(2)  Targeting  and  refining  audiences 

43  Facebook  offers  various  options  to  refine  the  criteria  for  a  target  audience  for  each  ad. 

44  Audiences  can  be  specified  based  on  their  location,  age,  sex,  language  and  other 
demographic  data,  interests  and  behaviour  in  the  Ads  Manager.  The  location  can  be 
further  specified  based  on  the  following  criteria:  ..Everyone  in  this  location",  ..People 
who  live  in  this  location",  ..People  recently  in  this  location",  ..People  travelling  in  this 
location".  Age  can  be  specified  by  exact  age  categories,  with  13  being  the  minimum 
age  and  65+  being  the  highest  age  category.  The  following  subcategories  are  available 
for  demographic  data:  “Education",  “Financial”,  “Generation”,  “Home”,  “Life  Events”, 
“Parents”,  “Politics”,  ’’Relationship”.  “Interests”  are  further  specified  as  “Business  and 
Industry”,  “Shopping  and  fashion”,  “Food  and  drink”,  “Family  and  relationships”, 
“Fitness  and  wellness”,  “Hobbies  and  activities”,  “Sports  and  outdoors”,  “Technology”, 
and  “Entertainment”.  “Behaviours”  are  categorised  as  “Automotive”,  “Digital  activities”, 
“Expats”,  “Financial”,  “Anniversary”,  “Purchase  behaviour”,  “Consumer  classification”, 
“Multicultural  affinity”,  “Mobile  device  user”,  “Travel”,  “Residential  profiles”,  “Seasonal 
and  events”,  “Home  owners”,  etc.  Each  of  these  categories  can  be  further  specified, 
e.g.  as  “In  a  Civil  Union”,  “Divorced”,  “Separated”,  “In  a  relationship”,  “It’s  complicated”, 
“In  a  Domestic  Partnership”,  “Open  relationship”,  “Single”,  “Engaged”,  “Married”, 
“Widowed”,  etc.  in  the  case  of  the  “Relationship”  category. 

45  By  using  Custom  Audiences,  advertisers  can  target  an  audience  which  matches 
precise  criteria.  The  customer  data  they  upload  to  the  Facebook  server  are  matched 
with  data  collected  on  the  social  network  to  create  their  own  target  group,  which 
consists  of  users  identified  as  relevant  to  their  campaigns.  They  can  save  their  target 
group  in  the  Ad  Manager  and  use  it  for  campaigns  on  Facebook.com,  Instagram  or  the 
Facebook  Audience  Network.  Facebook  offers  various  types  of  Custom  Audiences.33 

46  A  special  Facebook  interface  (“Facebook  Pixel”,  see  details  under  c.  below)  allows 
advertisers  to  use  their  list  of  customers  as  a  basis  for  a  Custom  Audience.  It  shares 
the  data  with  Facebook  in  encrypted  form.  The  data  contains  different  pieces  of 
information  on  the  target  person  (e.g.  first  and  last  name,  phone  number,  e-mail 
address,  town,  country,  date  of  birth,  age,  sex,  Facebook  ID  or  mobile  advertising  IDs 


31 

32 


[■■■] 

[■■■] 

[...] 
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to  identify  smartphones,  e.g.  Android’s  Advertising  ID  (AAID)  or  Google’s  “Apple’s 
Advertising  Identifier  (IDFA).34 

47  Custom  Audiences  can  also  be  based  on  information  about  which  users  have  visited 
the  advertiser’s  website35  or  app36,  allowing  them  to  address  Facebook  users  who  have 
visited  the  advertiser’s  website  in  the  last  30  days  or  who  have  viewed  specific 
products. 

48  Another  option  is  to  build  a  Custom  Audience  based  on  data  on  Facebook  users’ 
engagement  with  the  advertiser’s  content  (“Engagement  Custom  Audiences”).37 
“Engagement”  refers  to  activities  on  Facebook.com  like  viewing  a  video  or  an 
advertisement. 

49  Advertisers  can  also  create  Lookalike  Audiences  with  Facebook  users  who  are 
“similar”  to  their  customers  and  are  thus  potentially  interested  in  their  products.38 
Lookalike  Audiences  are  based  on  a  “source  audience”,  which  can  consist  of  a  list  of 
existing  customers,  a  Custom  Audience  of  the  advertiser,  a  list  of  users  of  a  particular 
Facebook  site  or  users  having  been  determined  as  potential  buyers  on  one  of  the 
advertiser’s  websites.39  Facebook  analyses  the  source  audience  with  regard  to 
commonalities  between  the  members  of  the  target  group  (personal  aspects  like  age, 
employer,  industry,  region,  etc.  or  online  behaviour,  response  to  advertising,  etc.). 
Facebook  then  looks  for  users  sharing  these  characteristics.  These  users  are  the 
“Lookalike  Audience”,  which  is  added  to  the  advertiser’s  target  group  and  which  can  be 
further  specified  by  applying  the  targeting  options  described  above.40 

c.  Developer  platform  and  Facebook  Business  Tools 

50  Linder  the  umbrella  of  “Facebook  Business  Tools”,  Facebook  offers  businesses  a 
variety  of  tools  and  products  to  utilise  the  network’s  reach  and  information  as  well  as 
the  access  to  Facebook  users  for  various  business  purposes.  Facebook  claims  that 
these  products  are  meant  to  help  businesses  “integrate,  use  and  exchange  information 
with  Facebook.”41  The  products  address  website  owners,  developers,  advertisers  and 
other  companies,  who  can  incorporate  Facebook’s  pre-defined  Application 


34  https://www.facebook.com/business/help/570474483033581  ?helpref=paae  content.  L .  .1 

35  https://www.facebook.com/business/help/44954295851 0885/?helpref=hc  fnav  ,  f...1 

36  https://www.facebook.eom/business/help/1 472206006327390/?helpref=hc  fnav  ,  [...] 

37  https://www.facebook.eom/business/help/1 707329062853572/?helpref=hc  fnav  ,  [...] 

38  [■■■] 

39  https://www.facebook.com/business/learn/facebook-ads-lookalike-audiences1  f...1 

40  [■■■] 

41  Facebook  Business  Tools  Terms  under  https://www.facebook.com/legal/terms/businesstools  [...] 
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Programming  Interfaces  (APIs)  into  their  own  websites,  apps  and  online  offers  or  offers 
on  the  Facebook  platform  via  a  configurator.  Facebook  does  not  charge  a  monetary 
fee  for  this  service. 

51  Facebook  describes  various  tools  on  the  “Facebook  for  Developers”  site:  Currently 
these  are  “Account  Kit“,  “App  Ads“,  “App  Links",  “Audience  Network"  “Facebook 
Analytics",  “Facebook  Business  SDK",  “Facebook-Login“,  “Facebook  Pixel",  “Groups 
API",  “Instagram  Graph  API",  “Marketing  Graph  API",  “Messenger  Platform",  “Pages 
API",  “Places  Graph"  and  “Workplace".  The  products  “Audience  Network”,  “Instagram 
Graph  API”,  “Instant  Articles”,  and  “Live  Video  API”  are  listed  under  “Publishing”.  The 
tab  Social  Integrations  lists  the  “Group  Plugin”,  “Instagram  Graph  API”  again,  “Sharing” 
and  the  subcategory  “Social  Plugins”  with  the  tools  “Group  Plugin”,  “Save”,  “Like, 
Share,  Send  &  Quote”,  “Embedded  content  and  video  player”,  “Page  Plugin”, 
“Comments”  and  the  “Messenger  Plugin”.  There  is  also  a  Gaming  tab  listing  “Facebook 
Gameroom”,  “Game  Payment”,  “Games  on  Facebook”,  “Instant  Games”,  “PC  Games 
SDK”  and  “Unity  SDK”.  The  site  also  lists  “AR  Studio”  (formerly  “Camera  Effects 
Platform”  and  the  artificial  intelligence  service  “wit.ai”). 

52  There  are  various  applications  of  Facebook  Business  Tools.  Essentially  businesses 
can  use  the  products  to  interact  with  Facebook  users  on  the  company  website  (outside 
Facebook.com)  and  initiate  actions  both  on  the  social  network  and  on  their  own 
websites  or  apps  (especially  social  plugins,  Facebook  Login,  Account  Kit).  Businesses 
can  also  use  the  products  to  develop  and/or  incorporate  contents  and  apps  on  the 
Facebook  platform  or  their  own  Facebook  company  pages  (e.g.  Pages  API,  Live  Video 
API,  Graph  API,  Games  on  Facebook).  Facebook  Business  Tools  also  inform 
companies  about  different  kinds  of  Facebook  user  behaviour  with  regard  to  the 
company  (measurement  and  analysis  tools  like  Facebook  Analytics  or  Facebook  Pixel). 

53  The  products  Facebook  describes  as  individual  tools  overlap  in  some  aspects  and  can, 
for  example,  be  part  of  another  tool.  The  APIs,  SDKs,  Pixel  and  Plugins  described 
above  are  normally  the  technical  basis  for  the  products  which  are  based  on  them,  e.g. 
by  linking  the  business  website  to  Facebook  and  giving  access  to  the  Facebook 
platform.  Facebook  Analytics,  for  instance,  requires  Facebook  Pixel,  Facebook  login 
requires  Facebook  SDK,  Games  on  Facebook  can  be  realised  with  Unity  SDK  or  other 
tools,  and  the  Facebook  Payment  API  is  available  for  games  payments. 

54  For  the  present  proceeding  especially  the  tools  linking  Facebook.com  with  companies 
operating  websites  or  apps  outside  of  and  independently  from  Facebook.com  are 
relevant.  Of  the  products  described  above,  these  are  mostly  the  social  plugins  (see 
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(1)  Facebook  Login  and  Account  Kit  (see  (2),  Facebook  Analytics  and  other 
measurement  and  analysis  tools  requiring  Facebook  Pixel  or  SDK  (see  3). 

(1)  Social  plugins 

55  With  incorporated  social  plugins  companies  allow  users  of  their  apps  or  websites  to 
integrate  and  share  their  contents  in  the  Facebook.com  social  network  in  various  ways. 
Plugins  serve  to  create  buttons  in  a  website  or  app  which  allow  users  different  types  of 
“social  actions”.  The  following  social  plugins  are  available  from  the  Facebook  for 
Developers  website:  “Comments",  “Embedded  comments",  “Embedded  posts", 
“Embedded  video  player",  “Group  Plugin",  “Like”  button,  “Page  Plugin",  “Quote  Plugin", 
“Save"  button,  “Share”  button. 

56  The  best-known  and  most  used  plugin  is  the  “Like”  button.  When  activated  on  third- 
party  websites  or  apps,  the  button  connects  the  user’s  “Like”  of  the  site  and  displays 
the  website  or  content  in  the  Newsfeeds  of  his/her  Facebook  friends. 

57  The  “Share”  button  is  also  a  widely  used  plugin.  Users  can  share  content  of  websites 
or  apps  outside  of  Facebook.com  with  their  Facebook  friends  and  at  the  same  time 
publish  a  status  report  containing  a  comment  on  that  content. 

58  Many  websites  and  some  apps  also  contain  Facebook’s  “Page  plugin”.  With  this  plugin 
the  publisher’s  Facebook  page  can  be  incorporated  into  the  company  website  in  full  or 
in  part.  Depending  on  the  configuration,  visitors  can  also  use  the  Like  and  Share 
functions  via  this  plugin  and  subscribe  to  (or  “follow”)  the  company  on  Facebook  via  its 
website. 

59  The  “Comment”  plugin  is  also  used  on  many  websites  and  in  some  apps.  Using  their 
Facebook  accounts  including  the  profile  picture  users  can  discuss  topics  on  the  website 
and  mark  postings  as  “Liked”.  The  “Embedded  comments”  plugin  serves  to  transfer 
comments  made  on  Facebook.com  regarding  the  website  or  app  or  its  respective 
content  to  the  website  or  app  and  display  them  there  as  well.  Public  posts  can  be 
transferred  to  and  displayed  on  websites  or  apps  with  the  “Embedded  content”  plugin. 
The  “Embedded  video  player”  serves  to  show  Facebook  videos  on  other  websites  or 
in  apps.  The  “Quote”  button  is  less  significant.  It  can  be  used  to  share  a  text  passage 
selected  on  a  website  on  Facebook.com.  The  “Save”  button  lets  users  save  articles  or 
services  on  a  private  list  on  Facebook.com.  They  can  also  share  it  there  and  receive 
notifications.  The  “Group  plugin”  is  a  new  feature  allowing  users  to  join  a  Facebook 
group  via  a  link  contained  in  an  e-mail  or  on  a  website. 

60  From  a  technological  point  of  view,  social  plugins  can  be  implemented  via  coding 
interfaces  for  websites  or  apps.  The  essential  tool  required  is  a  “Software  Development 
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Kit”  (SDK).  An  SDK  is  a  collection  of  programming  tools  and  libraries  required  for 
developing  a  software  in  a  specific  environment.  Facebook  provides  various  SDKs  for 
download  on  its  website.  The  “Facebook  SDK”  is  intended  for  integrating  social  plugins 
into  apps  for  the  mobile  platforms  iOS  and  Android.  The  “Facebook  SDK  for  JavaScript” 
or  so-called  Frames  (inline  frames)  serve  to  incorporate  social  plugins  on  a  website. 
An  Frame  is  an  element  of  Flypertext  Markup  Language  (FITML)  which  is  used  to 
structure  websites  with  links,  pictures  and  other  content  types. 

61  All  interfaces  support  data  flows  from  the  user  to  Facebook.com,  which  do  not  depend 
on  the  actual  activation  of  the  plugin’s  functionality  by  the  users  of  the  website  or  app 
(for  details  see  para.  139ff.). 

(2)  Facebook  Login  and  Account  Kit 

62  “Facebook  Login”  and  “Account  Kit”  are  widely-used  tools  supporting  the  login  process 
on  third-party  websites  and  apps. 

63  Users  identify  themselves  with  their  Facebook  registration  data  (e-mail  address  or 
mobile  phone  number  and  Facebook  password)  on  third-party  websites  with  “Facebook 
Login”.42  They  can  also  transfer  personal  data  to  the  app  to  avoid  having  to  create  a 
new  user  profile  when  registering  with  a  new  app  or  website. 

64  Facebook  Login  is  available  for  all  standard  platforms  and  operating  systems:  For  iOS, 
Android,  Web  and  Windows  Phones,  for  desktop  apps  and  for  smart  TVs,  “Internet-of- 
Things"  objects  and  similar  devices.  Users  logging  in  via  the  Facebook  Login  can  use 
the  service  on  several  devices  and  platforms  as  their  user  ID  remains  the  same.43  The 
“Account  Kit”  complements  Facebook  Login  by  enabling  users  to  create  a  user  profile 
on  a  third-party  website  or  app  simply  by  entering  their  phone  numbers  or  e-mail 
addresses  without  having  to  enter  a  password.44  This  product  is  available  to  both 
registered  and  non-registered  Facebook  users.45  It  can  be  used  for  the  web  and  mobile 
iOS  and  Android  platforms. 

65  From  a  technological  point  of  view  Facebook  Login  and  Account  Kit  are  implemented 
when  the  corresponding  Facebook  SDK  is  implemented,  which  can  only  be  done  with 
Facebook  JavaScript  SDK  for  websites.  Again,  the  SDKs  supply  Facebook  with 
information  on  which  users  create  an  account  using  which  data  on  a  third-party  website 
even  though  the  button  was  not  actually  used  (see  details  in  para.  143ff.). 


42  [...] 

43  https://develoDers.facebook.com/docs/facebook-login/overview/,  T...1 

44  [■■■] 

45  https://developers.facebook.com/docs/accountkit/overview/ ,  f. .  .1 
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(3)  Analysis  and  measurement  tools 

66  There  are  further  Facebook  Business  Tools  which  primarily  serve  to  analyse  and 
measure  the  customers’  behaviour.  These  can  be  further  categorised  as  tools  for 
measuring  the  performance  of  a  paid  advertisement  (see  a)  on  the  one  hand  or  as 
Facebook  Analytics  for  third-party  websites  and  apps  to  analyse  their  sites  or  apps  (see 
b)  on  the  other  hand. 

(a)  Ads  reporting 

67  Part  of  Facebook’s  offer  for  advertisers  in  the  area  of  online  advertising  is  a  variety  of 
functions  to  measure  the  performance  of  their  advertisements.  The  Ads  Manager 
contains  various  reporting  functions  to  create  statistics  and  analyses  on  users’ 
interaction  with  Facebook  advertisements  (Ads  Reporting).46  These  functions  allow 
advertisers  to  see,  for  example,  how  many  people  viewed  their  advertisement.  They 
can  also  see  details  on  the  users’  demographics  and  the  location  where  the 
advertisement  was  viewed,  and  they  can  adjust  the  settings  accordingly  (audience, 
placement,  budget),  or  stop  or  rerun  the  advertisement.47 

68  The  Ads  Manager’s  “Audience  Insights”  function  shows  advertisers  detailed  information 
on  the  audience  they  reached  with  their  advertisements.  The  statistics  contain 
demographic  information  (age,  relationship  status,  sex,  education,  job,  etc.), 
information  on  interests  and  lifestyle  of  the  users,  pages  they  “liked”  and  purchase 
information  on  their  online  shopping  behaviour,  location  data  etc. 

69  The  reporting  options  go  even  further  than  just  monitoring  users  while  on 
Facebook.com.  They  can  also  comprise  user  “events”  on  third-party  websites  and 
apps,  which  can  then  be  attributed  to  the  advertisement  under  review.  This  information 
cannot  flow  unless  Facebook  Pixel  has  been  installed  on  the  websites  or  apps. 
Facebook  Pixel  is  a  tracking  pixel,  which  is  incorporated  in  a  service  as  an  often 
invisible  graphic  and  loaded  by  the  browser  whenever  the  website  is  accessed.  It  is  a 
snippet  of  JavaScript  code  that  allows  advertisers  to  track  users’  opening  the  website 
and  to  collect  other  data.  Advertisers  can  select  from  a  pre-defined  list  of  nine  types  of 
“events”  and  configure  up  to  100  further  events  themselves.  Facebook  tracks  these 
events  via  the  interface  to  third-party  websites  and  apps  and  analyses  them  for  the 


46  https://de-de.facebook.com/business/learn/facebook-ads-measurinq-results,  [...1 

https://de-de.facebook.com/business/learn/facebook-ads-reporting-ads-manaaer .  [...] 
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advertisers.48  User  activities  within  28  days  after  clicking  on  an  advertisement  are 
normally  attributed  to  the  ad.49 

70  The  “Attributions”  tool  also  allows  advertisers  to  measure  the  performance  of  their 
campaign  across  several  channels  and  to  compare  several  campaigns.  “Facebook 
brand  lift  studies”  help  advertisers  understand  how  well  their  brand  campaign 
resonated  with  people  and  raise  brand  awareness.50  “Audience  Insights”  is  a  tool  for 
businesses  which  have  created  Custom  Audiences.51  Audience  Insights  is  a  Facebook 
service  providing  companies  with  aggregated  demographic  and  interest-based 
information  on  the  Custom  Audience.52  “Sharing  Insights”  gives  third-party  providers  of 
apps  and  websites  an  insight  into  how  users  share  their  content  on  Facebook.com. 
They  receive  (aggregated)  statistics  on  the  audiences  (by  sex,  age,  town,  country)  and 
how  (by  post  or  comment)  and  what  with  (content  of  the  shared  comments)  they 
interacted  with  their  content  on  Facebook.com.  “Page  Insights”  is  a  free  function  for 
companies  having  a  company  page  on  Facebook.com.  It  provides  an  analysis  of  page 
usage.  Facebook  also  cooperates  with  third-party  providers  like  Nielsen  to  measure 
the  users’  consumer  behaviour  on  other  channels  like  TV,  search  engines,  etc.53 

(b)  Facebook  Analytics 

71  Facebook  Analytics  is  a  free  tool  for  operators  of  websites  and  apps  enabling  them  to 
analyse  their  own  online  services  and  obtain  aggregated  statistics  on  their  audience. 
Its  use  is  subject  to  creating  a  Facebook  account  and  a  “Business  Manager  Account”. 
It  is  not  necessary  to  have  a  Facebook  Page  to  use  the  tool.54  The  company  does  not 
have  to  run  advertisements  on  Facebook  to  use  Facebook  Analytics.  Technologically 
speaking,  Facebook  Pixel  incorporates  Facebook  Analytics  into  websites  while 
Facebook  SDK  incorporates  the  tool  into  apps.55 

72  Facebook  Analytics  provides  third-party  companies  with  aggregated  data  on  how  users 
interact  with  their  services  across  several  devices,  platforms  and  websites.  The  third- 
party  company  can  track  and  optimise  the  entire  “customer  journey”  on  mobile  devices, 
online  and  offline  and  in  other  channels.56  Facebook  offers  a  large  number  of 


48  [■■■] 

49  [...] 

50  [...] 

51  [...] 

52  [...] 

53  [...] 

54  [...] 

55  For  details  please  refer  to  https://developers.facebook.com/docs/analytics/quickstart,  [...] 


https://analvtics.facebook.com/)  [...] 
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measurement  tools,  e.g.  audiences  or  audience  statistics  and  analyses  of  user 
behaviour  (aggregated  statistics,  audiences  grouped  by  sex,  age,  household  income, 
language,  town,  country).57  Third-party  companies  can  select  the  “channels”  they  wish 
to  analyse  (e.g.  their  website,  their  app,  their  Facebook  Page,  etc.)  and  specify  the 
“events”  they  want  to  analyse.  They  can  choose  from  a  list  of  up  to  1000  different 
events.58  Since  February  2018  it  has  been  possible  to  combine  several  sources  (e.g.  a 
website  and  an  app)  in  an  “Analytics  Dashboard”  to  measure  the  company’s 
performance  across  various  sources. 

73  “Facebook  Analytics”  is  a  free  analysis  tool  which  is  used  by  more  than  [...]  third-party 
companies  worldwide  each  month.59 

3.  Instagram 

74  Instagram  is  a  service  for  sharing  photos  and  short  video  clips  and  is  often  referred  to 
as  a  “photo  network”  or  “photo  blogging”  service.  It  was  founded  by  Kevin  Systrom  and 
Mike  Krieger  in  201 0.  Facebook  bought  the  service  in  201 2  for  1  billion  US  dollars.  The 
service  has  been  growing  continuously,  reaching  1  billion  monthly  active  users  and 
more  than  500  million  daily  active  users  in  201 860,  [...]  of  them  in  Germany.61  The 
service  is  financed  through  advertising  and  available  free  of  charge.  While  most  users 
use  it  via  a  mobile  app  and  mobile  devices  with  an  integrated  camera,  a  simplified 
desktop  version  is  also  available. 

75  Private  users  have  to  register  via  the  mobile  app.  To  register,  they  have  to  enter  an 
email  address,  a  user  name  and,  as  an  optional  but  recommended  piece  of  information, 
a  phone  number.  They  can  also  upload  a  profile  picture  and  enter  further  personal 
information  under  “About”.  While  they  can  link  their  profile  to  their  Facebook  account, 
there  is  no  obligation  to  do  so. 

76  Users  create  a  contact  list  for  using  Instagram  either  by  using  their  address  books  or 
lists  of  friends  from  Facebook.com  or  Twitter  (via  the  Twitter  API)  or  by  looking  for 
people  they  know  on  the  network.  Instagram  also  suggests  potential  users  to  “follow”. 
When  following  other  users,  users  can  see  their  photos  and  posts  on  the  “Home”  page, 
which  displays  content  in  an  order  generated  by  an  algorithm  in  a  central  and  constant 


57 

58 

59 
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https://analytics.facebook.com/ ,[...! 

[■■■] 

[...] 

https://business.instagram.com/ ,  [...] 
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stream.  There  are  filters  available  to  alter  pictures  and  users  can  comment  on  them 
using  emoticons. 

77  They  can  use  the  Instagram  camera  to  take  pictures  or  record  videos  and  edit  them 
using  filters,  texts,  drawings  or  special  effects  before  sharing  them  with  other  users.  In 
addition  to  that,  they  can  add  hashtags  to  pictures.  The  hashtag  symbol  (#)  serves  to 
mark  key  words  to  make  sure  messages  labelled  with  certain  contents  or  topics  can  be 
found.  Instagram  copied  this  functionality  from  Twitter,  which  introduced  it  as  a 
characteristic  of  its  service  (see  para.  203  below).  Photos  can  also  be  marked  with  a 
location. 

78  Posts  can  either  appear  as  “Stories”  or  as  status  reports  on  the  “Home”  page.  In 
summer  201 6  Instagram  introduced  the  “Story”  function  which  is  similar  to  a  function  of 
the  same  name  offered  by  “Snapchat”  (see  para.  196).  Users  can  compile  photos  and 
videos  in  a  “slideshow”,  which  is  visible  for  24  hours  before  it  is  deleted  automatically. 
Figures  published  in  the  2nd  quarter  of  201 8  suggest  that  400  million  people  worldwide 
use  Instagram’s  Story  function.62  Postings  to  the  “Home”  page  are  displayed 
permanently. 

79  Every  user  profile,  and  hence  the  postings  it  contains,  are  public  by  default  on 
Instagram.  Users  can  change  this  setting  to  “private”,  making  postings  visible  to 
approved  subscribers  only.  The  stories  will  then  only  be  visible  to  users  who  subscribed 
to  the  profile.  It  is  possible  to  explicitly  exclude  individual  users  from  that  circle.  A  chat 
function  for  direct  communication  with  individual  users  is  available  too. 

80  There  is  also  a  search  function  for  areas  of  interest  (music,  sports,  style,  humour,  film 
and  television,  science,  beauty),  media  and  users. 

81  Further  users  of  the  service  include  companies  and  celebrities  who  can  be  followed  by 
other  users.  Companies  have  to  set  up  a  business  account  to  use  the  service.  More 
than  25  million  company  profiles  existed  worldwide  in  July  201 8. 63  Celebrity  accounts 
are  often  used  for  marketing  purposes  (“Influences”). 

82  Instagram  is  integrated  into  Facebook. corn’s  Ad  Manager.  Companies  wishing  to 
advertise  on  Instagram  must  have  both  a  Facebook  page  and  an  Instagram  company 
profile.  Advertisements  can  be  placed  in  different  formats  on  the  Instagram  feed  or  in 
Instagram  Stories.64 


62  https://allfacebook.de/toll/state-of-facebook  [,..t 

63  https://business.instaqram.com/qettinq-started/ ,  f...1 

64  https://www.facebook.com/business/ads-quide,  f . .  .1 
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4.  WhatsApp 

83  WhatsApp  Inc.  was  founded  by  Jan  Koum  and  Brian  Acton  in  California/USA  in  2009. 
Facebook  bought  the  company  for  19  billion  US  dollars  in  2014.  The  company’s  Irish 
subsidiary  WhatsApp  Ireland  Ltd.  provides  the  service  to  German  users.65  More  than  1 
billion  people  used  the  service  worldwide  in  2018,  [...]  of  whom  were  in  Germany.66 
WhatsApp  is  a  free  service  which  was  originally  developed  as  a  free  internet-based 
alternative  to  short  message  services  (SMS).  WhatsApp  is  available  as  an  app  and  as 
a  desktop  version. 

84  WhatsApp  is  an  instant  messaging  service  which  uses  a  network  protocol  for  data 
exchanges  between  computers.  This  protocol  is  proprietary  (“XMPP”).  To  communicate 
with  one  another,  users  need  the  app  and  an  internet  connection. 

85  Users  have  to  register  with  WhatsApp  providing  their  own  mobile  phone  number  after 
installing  the  app.  The  registration  of  a  WhatsApp  account  is  concluded  by  verifying  the 
mobile  phone  number  with  an  access  code  that  is  sent  via  SMS.  Users  are  asked  to 
allow  access  to  their  contacts  upon  registration.  WhatsApp  then  compares  all  the 
phone  numbers  from  the  contact  list  with  the  list  of  registered  WhatsApp  users  to  create 
the  WhatsApp  contact  list. 

86  Using  the  service,  users  can  send  and  receive  a  multitude  of  media  like  text  messages, 
photos,  videos,  documents,  locations,  voice  messages  and  voice  calls.67  Both  group 
chats  and  bilateral  messages  are  possible.  WhatsApp  emphasises  that  messages  sent 
and  calls  made  via  its  service  are  “end-to-end  encrypted”  for  security  reasons.  The 
encryption  was  developed  in  cooperation  with  Open  Whisper  Systems  to  ensure  that 
content  is  only  available  to  the  desired  contacts.68  Since  2016  WhatsApp  has  been 
offering  a  “Status”  function  displaying  status  reports  with  photos,  videos,  emoticons, 
texts  or  drawings  for  all  contacts,  similar  to  the  “Story”  function.  Figures  published  in 
the  2nd  quarter  of  2018  suggest  that  450  million  people  worldwide  use  WhatsApp’s 
Status  function.69 

87  WhatsApp  has  not  been  monetised  through  advertising  so  far.  In  September  2017 
WhatsApp  announced  that  it  would  develop  functions  in  future  which  would  make  it 


65  [...] 

66  [...] 

67  https://www.whatsapp.com/about/ ,  [...] 

68  https://www.whatsapp.com/securitv/  includes  a  link  to  a  “Technical  White  Paper'1  explaining  the  technical  details 
of  encryption,  [...] 

69  https://www.qiqa.de/unternehmen/whatsapp-inc/news/wtf-der-whatsapp-status-ist-ein-weltweiter-hit/  (in 

German,  last  accessed  on  1 5  January  201 9). 
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easier  for  businesses  to  communicate  with  private  users.70  The  WhatsApp  Business 
App  was  launched  in  early  201 8. 71  It  offers  additional  functions  like  business  profiles, 
away  messages  or  the  registration  of  landline  phone  numbers.72  While  chats  with 
customers  are  free  of  charge  for  businesses,  they  have  to  pay  for  real-time 
notifications.73  WhatsApp  Business  provides  businesses  with  aggregated  statistics, 
e.g.  on  the  number  of  messages  sent,  delivered  or  read.74  Running  ads  in  the 
WhatsApp  will  probably  also  be  possible  as  of  201 9. 75 


II.  Facebook’s  Terms  of  Service  and  Data  Policy 


88 
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Use  of  the  social  network’s  various  areas  and  functionalities  is  subject  to  specific 
conditions  which  Facebook  stipulates  in  comprehensive  sets  of  conditions  and  policies. 
Upon  registration,  private  and  business  users 
(advertisers,  publishers,  businesses, 
developers,  etc.)  have  to  agree  to  these 
conditions  before  they  start  using 

Facebook.com. 


Sign  Up 

It’s  free  and  always  will  be. 


Facebook's  Terms  of  Service76  (see  1)  are 
the  starting  point  for  all  user  groups  and 
Facebook  products. 


In  addition,  Facebook  refers  to  the  “Data 
Policy  ”77  (see  2.)  and  the  “Cookies  Policy  ”78 
(see  3.).  Furthermore,  the  terms  and 
conditions  of  other  Facebook  products  are 
significant  (see  4). 


70  https://bloq.whatsapp.com/10000633/Wir-entwickeln-f%C3%BCr-Menschen-%E2%80%93-und-ietzt-auch- 

Unternehmen?  [...] 

71  https://www.whatsapp.com/business  ,  [...] 

72  See  app  description  in  Google  Play  Store:  https ://plav.aooqle.com/store/apps/details?id=com.whatsapp.w4b. 
[...] 

73  https://www.heise.de/newsticker/meldunq/WhatsApp-Business-oeffnet-sich-fuer-qrosse-Firmen-4127059.html 

(in  German,  last  accessed  on  8  January  2019). 

74  https://www.whatsapp.com/business/ ,  [...] 

75  https://www.heise.de/newsticker/meldunq/Werbunq-bei-WhatsApp-Jetzt-wird-Geld-verdient-4128652.html  .  in 

German,  last  accessed  on  8  January  2019). 

76  https://www.facebook.com/leqal/terms/update  ,  f...1 

77  https://www.facebook.com/about/privacv/update,  f . . .] 

78  https://www.facebook.com/policies/cookies/,  f...1 
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1 .  Facebook  Terms  of  Service 

91  Facebook's  terms  of  service  generally  apply  to  the  use  of  all  products,  features,  apps, 
services,  technologies  and  software  that  Facebook  defines  as  “Facebook  Products” 
or  “Products”.  There  are  further  terms  of  service  that  apply  to  specific  areas  and  which 
are  referred  to  in  the  Facebook  Terms  of  Service.  In  some  cases  they  are  intended  to 
complement  the  general  Terms  of  Service  and  in  others  to  replace  them.  These  are  the 
“Community  Standards”79,  “Commercial  Terms”80,  “Ads  Policy”81,  “Terms  for  Self-Serve 
Ads”82,  “Pages,  Groups  and  Events  Policy”83,  “Facebook  Platform  Policy”84,  “Developer 
Payment  Terms”85,  “Community  Payment  Terms”86,  “Commerce  Policies”87,  “Facebook 
Brand  Resources”88  and  “Music  Guidelines”89.  In  addition,  the  “Facebook  Business 
Tools  Terms”,  which  are  not  mentioned  in  the  Terms  of  Service,  entered  into  force  on 
25  May  201 8.90 

92  The  term  "Facebook  Products”  is  explained  in  more  detail  via  a  hyperlink.91  According 
to  this  information,  “the  Facebook  Products  include  Facebook  (including  the  Facebook 
mobile  app  and  in-app  browser),  Messenger,  Instagram  (including  apps  like  Direct  and 
Boomerang),  Portal-branded  devices,  Moments,  Bonfire,  Facebook  Mentions,  Spark 
AR  Studio,  Audience  Network,  and  any  other  features,  apps,  technologies,  software, 
products,  or  services  offered  by  Facebook  Inc.  or  Facebook  Ireland  Limited  under  our 
Data  Policy.  ”  The  Facebook  Products  also  include  Facebook  Business  Tools,  which 
are  tools  used  by  website  owners  and  publishers,  app  developers,  business  partners 
(including  advertisers)  and  their  customers  to  support  business  services  and  exchange 
information  with  Facebook,  such  as  social  plugins  (like  the  "Like"  or  "Share"  button) 
and  our  SDKs  and  APIs.92 

93  The  Terms  of  Service  define  the  range  of  services  provided  by  Facebook  in  Paragraph 
1  “Our  Services”.  There  is  a  headline  for  each  service  Facebook  provides  with 
examples  for  each  of  them.  The  following  headlines  are  listed:  We  “Provide  a 

79  https://www.facebook.com/communitvstandards/ .  [...] 

80  https://www.facebook.com/leqal/commercial  terms  ,  [...] 

81  https://www.facebook.com/policies/ads/ ,  [...] 

82  https://www.facebook.com/leaal/self  service  ads  terms  .  [...] 

83  https://www.facebook.com/policies/paqes  groups  events/ ,  [...] 

84  https://developers.facebook.com/policv/,  f...1 

85  https://developers.facebook.com/policv/credits  .  [...] 

86  https://www.facebook.com/payments  terms,  f...1 

87  https://www.facebook.com/policies/commerce  .  [...] 

88  https://en.facebookbrand.com  ,  [...] 

89  https://www.facebook.com/leaal/music  guidelines  .  [...] 

90  https://www.facebook.com/leaal/technoloav  terms,  [...] 

91  https://www.facebook.eom/help/1 561 4854740741 39?ref=tos  ,  [...] 

92  https://www.facebook.eom/help/1 561 4854740741 39?ref=tos  .  [...] 
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personalized  experience  for  you”,  “Connect  you  with  people  and  organizations  you  care 
about”,  “Empower  you  to  express  yourself  and  communicate  about  what  matters  to 
you”,  “Help  you  discover  content,  products,  and  services  that  may  interest  you”, 
“Combat  harmful  conduct  and  protect  and  support  our  community”,  “Use  and  develop 
advanced  technologies  to  provide  safe  and  functional  services  for  everyone”, 
“Research  ways  to  make  our  services  better”,  “Provide  consistent  and  seamless 
experiences  across  the  Facebook  Company  Products”,  “Enable  global  access  to  our 
services”. 

94  The  Terms  of  Service  contain  data  processing  regulations  regarding  the  content  users 
create  and  share  (Paragraph  3.3.1 .)  and  the  use  of  the  user  name,  profile  picture  and 
information  about  users’  actions  with  ads  and  sponsored  contents  (Paragraph  3.3.2.). 
In  all  other  respects,  Paragraph  2  of  the  Terms  of  Service  indicates  under  the  heading 
“Our  Data  Policy  and  your  privacy  choices”:  “We  collect  and  use  your  personal  data  in 
order  to  provide  the  services  described  above  to  you.  You  can  learn  about  how  we 
collect  and  use  your  data  in  our  Data  Policy  [hyperlink].  We  also  encourage  you  to 
review  the  privacy  choices  [hyperlink]  in  your  settings.  They  determine  how  we  use 
data”. 

95  The  Terms  of  Service  also  contain  provisions  regarding  the  general  use  of  the  social 
network,  imposing  certain  obligations  on  users,  for  instance,  to  use  the  name  they  use 
in  everyday  life,  provide  accurate  information  on  themselves,  be  at  least  13  years  old 
(Paragraph  3.1),  or  not  to  do  or  share  anything  that  is  unlawful  (Paragraph  3.2). 

96  According  to  Paragraph  5,  these  terms  make  up  the  entire  agreement  between  the 
users  and  Facebook  Ireland  Limited  regarding  the  use  of  Facebook  Products.  The 
terms  further  state  that  if  the  user  is  a  “consumer”  and  habitually  resides  in  a  Member 
State  of  the  European  Union,  the  laws  of  that  Member  State  apply  to  any  claim. 
Consumers  may  resolve  their  claims  in  any  competent  court  in  that  Member  State  that 
has  jurisdiction  over  the  claim.  In  cases  where  the  user  is  not  a  consumer,  the  claim 
must  be  resolved  in  a  competent  court  in  the  Republic  of  Ireland  and  Irish  law  governs 
the  terms. 

2.  Data  Policy 

97  The  Data  Policy  is  supposed  to  inform  Facebook  users  about  how  their  data  are 
handled.  It  describes  which  kind  of  data  (“information”)  is  “collected”  by  Facebook  and 
how  it  is  “processed”  and  “shared”.  As  for  the  Terms  of  Service,  the  Data  Policy  applies 
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to  all  Facebook  Products  unless  stated  otherwise.  The  Data  Policy  contains  many 
hyperlinks  to  other  documents.93 

98  The  Data  Policy  provides  an  overview  of  the  data  Facebook  collects  under  Paragraph 
I.  Facebook  collects  all  data  associated  with  the  use  of  any  of  the  Facebook  Products. 
Other  than  the  information  actively  shared  by  the  users,  this  also  includes  data 
automatically  transmitted  to  Facebook  by  the  browser  or  device  while  the  network  is 
used.  It  includes,  for  example,  information  on  people,  pages  or  groups  the  users  are 
connected  to  or  interact  with  (“Networks  and  connections”).  The  contact  information  the 
user  uploads,  synchronises  or  imports  from  a  device  is  collected.  Facebook  collects 
information  on  which  content  users  view  and  how  they  interact  with  this  content  or 
which  transactions  they  carry  out. 

99  Facebook  indicates  what  information  it  collects  on  the  computers,  phones,  connected 
TVs  and  other  web-connected  devices  used  if  they  integrate  with  Facebook  Products 
under  the  headline  “Device  Information”.  Facebook  combines  this  information  across 
the  devices  and  services  used  by  the  user.  This  includes  a  large  number  of  device 
attributes  (operating  system,  hardware  and  software,  browser  type  etc.),  information 
about  operations  and  activities  performed  on  the  device,  identifiers  (device  IDs  and 
other  identifiers,  such  as  from  games,  apps  or  accounts  and  Family  Device  IDs ),  device 
signals  (Bluetooth,  WLAN  signals  etc.)  data  from  device  settings  (“information  that  you 
allow  us  to  receive  through  device  settings  that  you  turn  on,  such  as  access  to  your 
GPS  location,  camera  or  photos  etc.”),  network  and  connections  (“information  such  as 
the  name  of  your  mobile  operator  or  ISP,  IP  address,  mobile  phone  number”)  and  “data 
from  cookies  stored  on  your  device,  including  cookie  data  that  refers  to  Facebook  and 
Instagram  Cookies  Policy”. 

100  Pursuant  to  the  Data  Policy,  Facebook.com  can  also  collect  data  on  user  activities  off 
Facebook.com  from  advertisers,  app  developers  and  publishers  (referred  to  as 
“partners”)  who  use  Facebook  Business  Tools.  Facebook  states  in  its  Data  Policy  that 
partners  “provide  information  about  your  activities  off  Facebook — including  information 
about  your  device,  websites  you  visit,  purchases  you  make,  the  ads  you  see,  and  how 
you  use  their  services — whether  or  not  you  have  a  Facebook  account  or  are  logged 
into  Facebook”.  Facebook  also  registers  information  on  online  and  offline  actions  and 
purchases  from  third-party  data  providers. 

101  Under  IV.  Facebook  explains  how  the  “Facebook  Companies”  work  together.  It 
includes  a  hyperlink  to  further  information  on  “Facebook  Company  Products”.  It  is 
explained  that  the  Facebook  Company  Products  are,  together,  the  Facebook  Products. 
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https://www.facebook.com/about/Qrivacv/update,  version  of  1 9  April  2018,  [. . .] 
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“They  also  include  other  products  provided  by  the  Facebook  Companies  that  are 
subject  to  a  separate,  stand-alone  terms  of  service  and  privacy  policy,  including  the 
WhatsApp,  Oculus,  Masquerade,  and  CrowdTangle  websites,  products,  or  apps". 
Facebook  says  it  also  processes  user  data  “across  the  Facebook  Companies  for  these 
purposes,  as  permitted  by  applicable  law  and  in  accordance  with  their  terms  and 
policies”.  Facebook  claims  this  is  to  “provide  an  innovative,  relevant,  consistent  and 
safe  experience"  across  all  Facebook  Company  Products  used. 

102  Paragraph  II  of  the  Data  Policy  indicates  that  Facebook  uses  the  information  as 
described  in  the  following  and  “to  provide  and  support  the  Facebook  Products  and 
related  services  described  in  the  Facebook  Terms  and  Instagram  Terms". 

103  The  information  is  used  to  “provide,  personalize  and  improve  our  products".  Facebook 
explains  that  the  information  is  used  to  personalise  features  and  content  and  make 
suggestions  for  the  user  on  and  off  the  Facebook  Products  (e.g.  groups  or  events  users 
may  be  interested  in  or  topics  they  may  want  to  follow).  Facebook  states  that  it  uses 
the  connections,  preferences,  interests  and  activities  to  create  personalised  products 
that  are  unique  and  relevant  to  the  users  based  on  the  data  it  collects  on  them  and 
others  including  any  data  with  special  protections  they  choose  to  provide  where  they 
have  given  their  explicit  consent,  how  they  use  and  interact  with  the  Facebook 
Products,  and  the  people,  places  or  things  they  are  connected  to  and  interested  in  on 
and  off  the  Facebook  Products. 

104  To  this  end,  it  uses  information  across  Facebook  Products  and  devices  in  order  to 
provide  a  more  tailored  and  “consistent  experience”  on  all  Facebook  Products  used. 
Location-related  information  and  face  recognition  are  also  used  when  activated. 
Facebook  indicates  that  it  uses  the  information  for  product  research  and  development 
and  to  personalise  ads.  Users  find  additional  information  on  the  choices  they  can  make 
in  their  private  settings  by  clicking  on  a  hyperlink. 

1 05  In  their  private  settings,  users  have  the  option,  in  addition  to  the  privacy  settings  relating 
to  the  use  of  the  social  network  itself  (e.g.  settings  as  to  who  can  see  the  users’ 
content),  to  change  settings  in  their  "Ad  preferences"  and  to  block  certain  targeted 
advertisements  there.94  Users  can  choose  not  to  use  partner  information  -  that  is, 
information  collected  through  Facebook  Business  Tools  and  third-party  data  providers 
-  to  personalise  advertisements  on  Facebook.com. 

106  Facebook  says  it  also  uses  information  to  “provide  measurement,  analytics  and  other 
business  services”.  Facebook  says  it  uses  the  information  it  has  (including  users’ 
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activity  off  Facebook  Products,  such  as  the  websites  users  visit  and  ads  they  see)  to 
help  advertisers  and  other  partners  measure  the  effectiveness  and  distribution  of  their 
ads  and  services,  to  understand  the  types  of  people  who  use  their  services  and  how 
people  interact  with  their  websites,  apps  and  services.  Facebook  also  says  it  uses 
information  to  promote  safety,  integrity  and  security,  to  send  users  marketing 
communications  and  also  to  research  and  innovate  for  social  good. 

107  Facebook  explains  in  Paragraph  III  how  it  “shares”  its  information  with  other  people  or 
businesses.  In  addition  to  sharing  on  Facebook  Products,  this  also  includes  sharing 
with  "third-party  partners".  The  third-party  partners  also  include  partners  who  use 
Facebook  analytics  services.  Facebook  says  it  aggregates  statistics  and  insights  to 
show  how  people  are  engaging  with  their  posts,  listings,  pages,  videos  and  other 
content  on  and  off  Facebook  Products.  Information  is  also  shared  with  advertisers  who 
are  provided  with  reports  about  the  kinds  of  people  seeing  their  ads  and  how  their  ads 
are  performing.  Flowever,  it  does  not  share  information  such  as  names  or  e-mail 
addresses  that  identifies  individuals. 

108  Facebook  explains  the  following  under  Paragraph  V.  “What  is  our  legal  basis  for 
processing  data?": 

“We  collect,  use  and  share  the  data  that  we  have  in  the  ways  described  above: 

•  as  necessary  to  fulfil  our  Facebook  Terms  of  Service  or  Instagram  Terms  of  Use; 

•  consistent  with  your  consent,  which  you  may  revoke  at  any  time  through  the 
Facebook  settings  and  Instagram  settings; 

•  as  necessary  to  comply  with  our  legal  obligations; 

•  to  protect  your  vital  interests,  or  those  of  others; 

•  as  necessary  in  the  public  interest  and 

•  as  necessary  for  our  (or  others')  legitimate  interests,  including  our  interests  in 
providing  an  innovative,  personalised,  safe  and  profitable  service  to  our  users 
and  partners,  unless  those  interests  are  overridden  by  your  interests  or 
fundamental  rights  and  freedoms  that  require  protection  of  personal  data". 

109  A  hyperlink  ("Learn  more")  takes  the  reader  to  another  detailed  document  in  which 
Facebook  explains  the  legal  bases.95  For  all  people  who  have  the  legal  capacity  to 
enter  into  an  enforceable  contract,  Facebook  says  it  processes  data  “as  necessary  to 
perform  our  contracts  with  you”.  Facebook  describes  the  contractual  services  for  which 
this  data  processing  is  necessary  in  "Our  Services”.  Consent  is  provided  as  a  legal 
basis  for  processing  data  with  special  protections,  the  use  of  face  recognition 
technology,  the  use  of  partner  data  and  for  personalised  ads.  Facebook  asserts 
legitimate  interests  vis-a-vis  people  under  the  age  of  majority  (under  18)  -  vis-a-vis  all 
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users-  for  providing  measurement,  analytics  and  other  business  services,  for  marketing 
communications,  to  research  and  innovate  for  social  good,  to  comply  with  legal 
obligations,  to  protect  vital  user  interests,  and  to  perform  tasks  carried  out  in  the  public 
interest.  Last  but  not  least,  Facebook  points  out  that  when  it  processes  users’  data  as 
necessary  for  a  task  carried  out  in  the  public  interest,  users  have  the  right  to  object  to, 
and  seek  restriction  of,  its  processing. 

3.  Cookies  policy 

110  The  Cookies  Policy96  complements  the  Data  Policy  and  addresses  the  use  of  cookies 
and  other  storage  technologies. 

111  The  Cookies  Policy  defines  cookies  under  the  heading  "Cookies  and  other  storage 
technologies"  as  small  pieces  of  text  used  to  store  information  on  web  browsers.  It  says 
cookies  are  used  to  store  and  receive  identifiers  and  other  information  on  computers, 
phones  and  other  devices.  “Other  technologies,  including  data  we  store  on  your  web 
browser  or  device,  identifiers  associated  with  your  device,  and  other  software,  are  used 
for  similar  purposes.  In  this  policy,  we  refer  to  all  of  these  technologies  as  "cookies”. 

112  Facebook  uses  cookies  if  users  have  a  Facebook  account  or  visit  websites  and  apps 
that  use  Facebook  Products  (including  the  “Like”  button  or  other  Facebook 
Technologies).  Cookies  enable  Facebook  to  offer  the  Facebook  Products  to  users  and 
to  understand  the  information  it  receives  about  them,  including  information  about  their 
use  of  other  websites  and  apps,  whether  or  not  they  are  registered  or  logged  in. 

113  Under  the  heading  "Why  do  we  use  cookies”?,  Facebook  refers  to  authentication, 
security,  advertising  and  measuring  purposes  and  the  improvement  of  Facebook 
services. 

1 14  Under  the  heading  "Where  Do  We  Use  Cookies”?  Facebook  states  that  cookies  may 
be  placed  on  the  users’  computer  when  they  use  the  Facebook  Products  and  the 
products  provided  by  other  members  of  the  Facebook  Companies  and  websites  and 
apps  provided  by  other  companies  that  use  the  Facebook  Products,  including 
companies  that  incorporate  the  Facebook  Technologies  into  their  websites  and  apps. 
Facebook  obtains  device-related  information  and  information  about  user  activity  on  the 
third-party  websites  from  websites  and  apps  that  use  Facebook  Products  via  the  use 
of  cookies  without  requiring  any  further  action  on  the  part  of  the  user.  This  occurs 
whether  or  not  the  user  has  a  Facebook  account  or  is  logged  in.97 


96  https://www.facebook.com/policies/cookies/  version  of  4  April  2018,  f...1 

97  https://de-de.facebook.com/policies/cookies/ ,  [...] 
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115  The  Cookies  policy  also  makes  renewed  reference  to  the  above-mentioned  “Ad 
Settings”  under  the  heading  “How  can  you  control  Facebook's  use  of  cookies  to  show 
you  ads”?  that  enable  users  to  opt  out  of  using  partner  information  to  personalise  ads. 
Furthermore,  the  possibility  of  preventing  interest-based  online  advertising  from  being 
displayed  via  the  "European  Interactive  Digital  Advertising  Alliance"98  or  via  mobile 
phone  settings  is  pointed  out,  as  well  as  the  possibility  of  relevant  settings  in  the  users' 
own  browser.  In  doing  so,  Facebook  indicates  that  certain  parts  of  Facebook  products 
may  not  function  properly  if  browser  cookies  are  disabled. 

4.  Terms  and  conditions  for  other  Facebook  Products 

1 1 6  Facebook  refers  to  further  conditions  for  Facebook  Products  in  the  Facebook  T erms  of 
Service.  These  include  in  particular  the  terms  and  conditions  that  apply  to  the  other 
Facebook-owned  services  WhatsApp,  Instagram,  Oculus  and  Masquerade  (see  a.).  In 
addition,  the  conditions  for  the  use  of  Facebook  Business  Tools  are  relevant  (see  b.). 

a.  Facebook-owned  services 

117  The  Terms  of  Service  of  WhatsApp  (see  (1),  Instagram  (see  (2)  and  the  other  retail 
services  Oculus  and  Masquerade  (see  (3)  are  relevant  to  the  subject  matter  of  these 
abuse  proceedings. 

(1)  WhatsApp 

118  The  Terms  of  Service,  Privacy  Policy  and  other  cookie  usage  provisions99  are  similar 
to  those  of  the  Facebook.com  service.  The  WhatsApp  Terms  of  Service  contain  a 
comprehensive  description  of  what  the  service  offers  under  the  heading  "Our  Services" 
as  well  as  user  obligations,  limitations  of  liability,  jurisdiction  and  arbitration  agreements 
and  other  provisions.  The  Privacy  Policy  explains  what  information  is  collected, 
recorded,  used,  and  shared  and  sets  out  the  legal  basis  on  which  these  procedures 
are  based. 

119  As  such,  WhatsApp’s  privacy  policy  points  out  that  WhatsApp  is  one  of  the  "Facebook 
Companies"  and  provides  a  hyperlink  to  the  Facebook  page  for  a  definition  of  the  term. 
It  subsequently  says: 

“As  part  of  the  Facebook  Companies,  WhatsApp  receives  information  from,  and  shares 
information  with,  the  Facebook  Companies.  We  may  use  the  information  we  receive  from 
them,  and  they  may  use  the  information  we  share  with  them,  to  help  operate,  provide, 


http://www.youronlinechoices.eu/ ,  [...] 

The  full  text  is  available  at  https://www.whatsapp.eom/leaal/#terms-of-service.  in  the  version  of  24  April  2018, 
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improve,  understand,  customize,  support,  and  market  our  Services  and  their  offerings. 
This  includes  helping  improve  infrastructure  and  delivery  systems,  understanding  how 
our  Services  or  theirs  are  used,  helping  us  provide  a  way  for  you  to  connect  with 
businesses,  and  securing  systems.  We  also  share  information  to  fight  spam,  threats, 
abuse,  or  infringement  activities  and  promote  safety  and  security  across  the  Facebook 
Company  Products.  However,  your  WhatsApp  messages  will  not  be  shared  onto 
Facebook  for  others  to  see.  In  fact,  Facebook  will  not  use  your  WhatsApp  messages  for 
any  purpose  other  than  to  assist  us  in  operating  and  providing  our  Services”. 

120  A  hyperlink  (Learn  more)  takes  users  to  the  WhatsApp  "FAQ"  page,  where  WhatsApp 
explains: 


“Today,  Facebook  does  not  use  your  WhatsApp  account  information  to  improve  your 
Facebook  product  experiences  or  provide  you  more  relevant  Facebook  ad  experiences 
on  Facebook”. 

121  If  users  scroll  down,  they  find  the  information: 

“Today,  Facebook  does  not  use  your  WhatsApp  account  information  to  improve  your 
Facebook  product  experiences  or  provide  you  more  relevant  Facebook  ad  experiences 
on  Facebook”.  This  is  a  result  of  discussions  with  the  Irish  Data  Protection  Commissioner 
and  other  Data  Protection  Authorities  in  Europe.  We're  always  working  on  new  ways  to 
improve  how  you  experience  WhatsApp  and  the  other  Facebook  Company  Products  you 
use.  Should  we  choose  to  share  such  data  with  the  Facebook  Companies  for  this 
purpose  in  the  future,  we  will  only  do  so  when  we  reach  an  understanding  with  the  Irish 
Data  Protection  Commissioner  on  a  future  mechanism  to  enable  such  use”. 100 

122  If  users  scroll  down  a  bit  further,  they  are  advised  that: 

“WhatsApp  currently  shares  limited  categories  of  information  with  the  Facebook 
Companies.  This  consists  of  the  phone  number  you  verified  when  you  signed  up  for 
WhatsApp,  some  of  your  device  information  (your  device  identifier,  operating  system 
version,  app  version,  platform  information,  your  mobile  country  code  and  network  code, 
and  flags  to  enable  tracking  of  the  update  acceptance  and  control  choices),  and  some  of 
your  usage  information  (when  you  last  used  WhatsApp,  and  the  date  you  first  registered 
your  account,  and  the  types  and  frequency  of  your  features  usage)”. 101 

123  If  users  scroll  down  further,  they  will  find  the  information: 

“Importantly,  WhatsApp  does  not  share  your  WhatsApp  contacts  with  Facebook  or  any 
other  members  of  the  Facebook  Companies,  and  there  are  no  plans  to  do  so.  WhatsApp 
also  does  not  share  your  messages  with  Facebook.  In  addition,  WhatsApp  cannot  read 
your  messages  because  they  are  end-to-end  encrypted  by  default  when  you  and  the 
people  you  message  with  use  the  latest  version  of  our  app.  Only  the  people  you  message 
with  can  read  your  messages  -  not  WhatsApp,  Facebook,  or  anyone  else”.  102 

124  The  data  collected  and  stored  by  WhatsApp  is  assigned  to  Facebook  user  accounts 
via  the  so-called  Family  Device  ID,  which  is  installed  on  whatever  mobile  device  users 


100  https://faq.whatsapp.com/general/260001 12/?eea=1&lang=en,  [...] 

101  https://fag.whatsapp.com/general/2600Q1 1 2/?eea=1  &lanq=en,  [...] 

102  https://faa.whatsapp.com/aeneral/2600Q1 12/?eea=1&lang=en,  [...] 
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are  using103.  This  is  a  unique  identifier  for  each  user,  which  is  also  installed  when  using 
Facebook  and  which  identifies  the  user  when  data  are  matched. 

(2)  Instagram 

125  Instagram’s  Terms  of  Use,  Data  Policy  and  Cookies  Policy  are  very  similar  to  those  of 
Facebook  and  have  been  tailored  to  Instagram's  specific  services  and  offerings.  Many 
of  the  hyperlinks  to  the  definition  of  terms  in  the  documents  take  users  to  the  relevant 
Facebook  pages.  They  include  explanations  of  the  legal  bases  on  which  Instagram 
relies  for  data  processing. 

126  Instagram’s  privacy  policy  is  identical  to  Facebook's.104  This  means  the  same  amount 
of  information  on  Instagram  users  is  collected  and  used.  Accordingly,  the  wording  of 
Instagram's  Privacy  Policy  in  Paragraph  IV  “How  do  the  Facebook  Companies  work 
together”?  contains  the  same  wording  as  the  Facebook  Privacy  Policy  that  Facebook 
and  Instagram  share  infrastructure,  systems  and  technology  with  other  Facebook 
Companies  (which  include  WhatsApp  and  Oculus),  “to  provide  an  innovative,  relevant, 
consistent  and  safe  experience  across  all  Facebook  Company  Products”.  It  says  “We 
also  process  information  about  you  across  the  Facebook  Companies  for  these 
purposes  as  permitted  by  applicable  law  and  pursuant  to  their  terms  and  policiesV05 

127  The  data  collected  and  stored  by  Instagram,  as  well  as  the  WhatsApp  data,  can  be 
assigned  to  Facebook  user  accounts  because  a  Family  Device  ID  is  installed  on  the 
users'  device.  Unlike  WhatsApp,  the  Privacy  Policy  does  not  include  a  restriction  to 
certain  information  that  is  actually  assigned  to  and  combined  with  Facebook  user 
accounts.  In  these  legal  proceedings,  Facebook  indicated  in  relation  to  Instagram's 
actual  data  processing  before  the  service  was  transferred  to  Facebook  Ireland  Ltd.  that 
the  data  collected  in  any  event  includes  the  users’  contact  details  (mobile  phone 
number,  e-mail  address),  data  about  the  content  generated  by  the  user  on  Instagram 
and  data  about  the  users'  Instagram  via  the  users’  “contact  graph",  for  instance  about 
the  persons  whom  the  user  "follows"  on  Instagram".106  This  includes  "log  file 
information",  (IP  address,  browser  type,  referring  pages/exit  pages  and  URLs,  the 
number  of  clicks,  interactions  with  the  Service's  links  as  well  as  domain  name,  landing 
page,  viewed  pages,  information  from  e-mails  sent  to  Instagram  users),  device  IDs, 


103  [...] 

104  https://www.facebook.com/policies/cookies/  version  of  19  February  2018,  [...] 

105  https://help.instaqram.com/51 95221 251 07875?helpref=paqe  content  under  Paragraph  IV.  “How  the  Facebook 
Companies  work  together”,  [...] 
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metadata  (e.g.  hash  tags,  geotags),  and  data  about  usage  behaviour  through  cookies 
used. 

(3)  Oculus  and  Masquerade 

128  The  Facebook-owned  services  Oculus  and  Masquerade  also  indicate  in  their  Terms  of 
Service  and  Data  Policy  that  they  share  data  with  Facebook. 

129  Oculus  has  strongly  aligned  its  Terms  of  Use  and  Privacy  Policy  with  Facebook.  The 
wording  under  the  heading  “How  the  Facebook  Companies  work  together”  is  identical 
to  the  wording  of  Facebook’s  Data  policy107,  that  Oculus  shares  infrastructure,  systems 
and  technology  with  other  Facebook  Companies  (which  include  Facebook,  Instagram, 
and  WhatsApp),  to  provide  users  with  an  innovative,  relevant,  consistent  and  safe 
experience  across  all  Facebook  Company  Products.  For  these  purposes,  Oculus 
processes  information  about  users  and  their  devices  across  Facebook  Companies  as 
far  as  permitted  by  applicable  law  and  its  Terms  of  Service  and  policies. 

130  When  using  Oculus,  Facebook  Technologies  Ltd.  collects  data  provided  by  Oculus 
users,  pursuant  to  the  Privacy  Policy,  and  automatically  collects  data  on  user  behaviour 
with  all  Oculus  offerings  and  services,  as  well  as  device-related  information,  device  IDs, 
location-related  information,  physical  movements  and  dimensions  (when  using  an  XR 
device),  photos  and  audio  content  when  accessed  with  permission,  information  from 
cookies,  pixels,  and  more.108 

131  Assignment  to  Facebook  user  accounts  is  made,  according  to  Facebook  -  if  the  user 
uses  a  Facebook  login  -  via  the  login,  otherwise  via  the  users’  e-mail  address  (which 
users  have  to  provide  when  they  sign  up  with  Oculus).109 

132  MSQRD/Masquerade's  Privacy  Policy  is  posted  directly  on  a  Facebook  page  and 
explains  from  the  outset: 

“Depending  on  which  sen/ices  you  use,  we  share  information  within  the  family  of  related 
companies  that  are  legally  part  of  the  same  group  of  companies  that  MSQFtD  is  part 
of,  or  that  become  part  of  that  group,  such  as  Facebook.  For  a  list  of  our  related 
companies,  please  see:  “Facebook  and  the  other  companies  in  the  Facebook  family 
may  use  information  from  us  to  improve  your  experiences  within  their  services  such  as 
making  product  suggestions  (for  example,  of  friends  or  connections,  or  of  interesting 
content),  and  to  show  relevant  offers  and  ads”. 

133  Data  collected  by  Masquerade  includes  information  that  users  provide  when  they 
create  an  account  and  content  users  create  or  provide  through  the  app,  including 


107  cf.  Data  policy  at  https://www.oculus.com/leaal/privacv-Dolicv/  in  the  version  of  4  September  2018,  [...] 

108  https://www.oculus.com/leqal/privacv-policv/  version  of  4  September  201 8,  [...] 

109  [■■■] 
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photos,  videos  or  masks.  Masquerade  also  collects  information  that  is  part  of  the  things 
users  share,  such  as  the  location  of  a  photo  or  the  date  on  which  a  file  was  created.  In 
addition,  it  also  collects  data  such  as  payment  information  (debit  or  credit  card 
information  in  relation  to  transactions),  use  of  third-party  websites  or  apps  that  integrate 
Masquerade  and  device-related  information.110 

1 34  Assignment  takes  place  according  to  the  information  provided  by  Facebook  -  if  the  user 
uses  a  Facebook  login  -  via  the  login,  or  via  a  device  ID.* 111 


b.  Facebook  Business  Tools 

135  Since  25  May  2018,  Facebook  Business  Tools  have  been  subject  to  separate  Terms 
of  Service,  which  apply  to  website  operators  and  website  owners,  developers, 
advertisers,  business  partners  (and  their  customers)  and  other  persons.  The  Facebook 
Terms  of  Service  do  not  contain  any  explicit  reference  to  these  terms  of  use. 


(1)  Provisions  set  forth  in  the  Terms  of  Service 

136  The  term  Facebook  Business  Tools  is  defined  comprehensively  in  the  Terms  of  Service 
and  includes 

“APIs  and  SDKs,  the  Facebook  pixel,  social  plugins  such  as  the  “Like”  and  “Share” 
buttons,  Facebook  Login  and  Account  Kit,  as  well  as  other  platform  integrations,  plugins, 
codes,  specifications,  documentation,  technology  and  services". 

137  Paragraph  1  of  Facebook  Business  Tools  Terms  says  that  Facebook  Business  Tools 
can  be  used  to  send  personal  data  to  Facebook  about  customers  and  users  ("Customer 
Data").  Depending  on  the  Facebook  Products  used,  Customer  Data  may  include: 

a.  "Contact  Information”  consists  of  information  that  personally  identifies 
individuals,  such  as  names,  email  addresses  and  phone  numbers  that  we  use  for 
matching  purposes  only.  We  will  hash  Contact  Information  that  you  send  to  us  via 
a  Facebook  JavaScript  pixel  for  matching  purposes  prior  to  transmission.  When 
using  a  Facebook  image  pixel  or  other  Facebook  Business  Tools,  you  or  your 
service  provider  must  hash  Contact  Information  in  a  manner  specified  by  us 
before  transmission. 

b.  "Event  Data "  includes  other  information  that  you  share  about  your  customers  and 
the  actions  that  they  take  on  your  websites  and  apps  or  in  your  shops,  such  as 
visits  to  your  sites,  installations  of  your  apps  and  purchases  of  your  products. 

138  Paragraph  2.  of  Facebook  Business  Tools  Terms  regulates  the  use  of  customer  data: 


1,0  https://www.facebook.com/msqrd/privacv  version  of  28  June  2018,  [...] 
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"a.  We  will  use  Customer  Data  for  the  following  purposes  depending  on  which 
Facebook  Company  Products  you  choose  to  use: 

i.  Contact  information  for  matching 

1.  You  instruct  us  to  process  the  Contact  Information  solely  to  match  the  Contact 
Information  against  Facebook's  or  Instagram's  user  IDs  ("Matched  user  IDs”),  as  well 
as  to  combine  those  user  IDs  with  corresponding  Event  Data.  We  will  delete  Contact 
Information  following  the  matching  process. 

Event  Data  for  measurement  and  analytics  services 

2.  You  instruct  us  to  process  Event  Data:  (a)  to  prepare  reports  on  your  behalf  on  the 
impact  of  your  advertising  campaigns  and  other  online  content  ("Campaign  Reports") 
and  (b)  to  generate  analytics  and  insights  about  your  customers  and  their  use  of  your 
apps,  websites,  products  and  services  ("Analytics"). 

3.  We  grant  to  you  a  non-exclusive  and  non-transferable  licence  to  use  the  Campaign 
Reports  and  Analytics  for  your  internal  business  purposes  only  and  solely  on  an 
aggregated  and  anonymous  basis  for  measurement  purposes.  You  will  not  disclose  the 
Campaign  Reports  or  Analytics,  or  any  portion  thereof,  to  any  third  party,  unless 
otherwise  agreed  to  in  writing  by  us.  We  will  not  disclose  the  Campaign  Reports  or 
Analytics,  or  any  portion  thereof,  to  any  third  party  without  your  permission,  unless  (i) 
they  have  been  combined  with  Campaigns  Reports  and  Analytics  from  numerous  other 
third  parties  and  (ii)  your  identifying  information  is  removed  from  the  combined 
Campaign  Reports  and  Analytics.  (...)  ” 

(2)  Data  collected 

139  The  integration  of  Facebook  Business  Tools  gives  Facebook  a  direct  connection  to  the 
website  or  app  so  that  user  data  goes  directly  to  the  Facebook  server  when  the  website 
or  app  is  called  up  or  used,  even  when  the  person  visiting  the  website  or  using  the  app 
does  not  activate  the  interfaces. 

140  Social  plugins  are  integrated  into  websites  via  Java  Script  SDK  or  1-Frame.112  This 
means  that  the  moment  users  load  the  web  page  in  their  browser,  an  HTTP  request  is 
automatically  generated113  and  sent  to  Facebook.  With  every  integrated  interface,  the 
IP  address,  the  browser  type,  the  URL  of  the  visited  website  and  the  time  of  the  visit 
are  transmitted  to  the  Facebook  servers  as  a  minimum  data  record  when  the  page  is 
accessed  via  a  standard  Internet  protocol.  If  Facebook  has  additionally  placed  cookies 
on  the  user’s  browser,  the  browser  transmits  additional  data  to  the  Facebook  server.114 


112  [...] 

1,3  HTTP  is  the  communication  protocol  in  the  World  Wide  Web  (WWW).  The  most  important  functions  are  to 
request  files  from  the  web  server  and  to  load  them  into  the  browser.  The  browser  then  displays  texts  and  images 
and  takes  care  of  the  display  of  audio  and  video  data.  Communication  takes  place  according  to  the  client-server 
principle.  The  HTTP  client  (browser)  sends  its  request  (HTTP  request)  to  the  HTTP  server  (Web  server).  This 
processes  the  request  and  returns  its  response  (HTTP  response).  After  the  server  has  sent  a  response,  this 
connection  is  terminated.  Typically,  several  HTTP  connections  take  place  simultaneously;  of. 
httos://www.elektronik-  komoendium.de/sites/net/0902231  .htm  (last  accessed  on  8  January  201 9). 

114  [...]  See  also  https://developers.facebook.com/docs/pluqins/faqs  (last  accessed  on  11  January  2019, [...]): 
“What  information  does  Facebook  get  when  I  implement  a  Social  Plugin  and  how  is  it  used?:  If  a  person  has 
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This  includes  data  such  as  the  URL  of  the  website  that  the  user  visited  prior  to  the 
relevant  website  or  the  transmission  of  a  "unique  identification  number",  via  which 
Facebook  users  can  automatically  be  assigned  to  their  Facebook  user  account.115 

141  Social  plugins  are  integrated  into  apps  via  the  Facebook  Sharing  SDK.  Via  the  SDK, 
Facebook  receives  information  such  as  the  Facebook  App  ID  (an  ID  that  Facebook 
assigns  to  the  mobile  app)  and  metadata  of  the  device  used.  This  includes,  inter  alia, 
the  operating  system  used,  device  model,  vendor,  screen  size,  processor  cores,  total 
storage  space,  free  storage  space,  name  and  version  of  the  app  used,  the  http  header 
record  and  IP  address  as  well  as  the  time  zone.116 

142  In  addition,  the  SDK  logs  and  captures  certain  "Events"  in  the  Facebook  Analytics  app. 
Facebook  makes  a  distinction  here  between  “Automatically  Logged  Events”,  “Implicit 
Events”  and  “Explicit  Events”.  “Automatically  Logged  Events"  include  basic  user 
interactions  in  the  app  such  as  app  installation  or  app  starts,  and  system  events  such 
as  SDK  loading  or  SDK  performance.  This  data  is  automatically  sent  to  Facebook 
unless  the  app  operator  has  explicitly  disabled  it.117  If  the  app  operator  uses  the 
integration,  such  as  the  "Like"  button,  further  data,  the  so-called  “Implicit  Events”  are 
sent  to  Facebook.  In  addition  to  these  preset  events,  the  app  operator  can  also 
configure  additional  app  "Event"  types,  so-called  “Explicit  Events”.118  Flere,  app 
operators  can  choose  from  a  wide  range  of  event  types:  These  events  can  be  data 
about  an  app  being  launched,  payment  data  being  added,  a  level  being  reached,  goods 
being  placed  in  the  shopping  cart  or  added  to  a  wish  list,  a  registration  or  tutorial  being 
completed,  a  purchase  being  started  or  completed,  a  rating  being  given,  a  product 
being  searched  for,  credits  being  issued,  a  success  being  achieved  or  a  content  being 
displayed.119  App  operators  can  track  actions  within  their  apps  by  selecting  such  events 
to  receive  the  corresponding  analysis  data. 

143  By  integrating  the  Facebook  Login  or  Facebook  Account  Kit,  Facebook  receives 
information  from  third-party  websites  and  apps  about  which  websites/apps  a  Facebook 


visited  Facebook  and  visits  your  website  with  a  social  plugin ,  the  browser  sends  us  information  in  order  to  load 
Facebook  content  on  that  page.  The  data  we  receive  may  include  info  like  the  person's  user  ID,  the  website 
they're  visiting,  the  date  and  time,  and  other  browser-related  information.  We  record  some  of  this  info  and  may 
use  it  to  improve  our  products  and  services  and  to  show  people  more  interesting  and  useful  ads",  [...] 

115 

116  FAQs  on  the  GDPR  “What  data  does  Facebook  collect  via  the  SDK?“,  available  at 
https://www.facebook.com/business/rn/one-sheeters/adpr-developer-faas  ,  [...] 

117  FAQs  on  the  GDPR,  “What  data  does  Facebook  collect  via  the  SDK?“,  available  at 

https://www.facebook.eom/business/m/one-sheeters/adpr-developer-fags,  [...] 

1.8  FAQs  on  the  GDPR  “What  data  does  Facebook  collect  via  the  SDK?“,  available  at 

https://www.facebook.eom/business/m/one-sheeters/gdpr-developer-fags,  [...] 

1.9  https://developers.facebook.com/docs/app-events/android  (using  Android  devices  as  an  example,  similar  to 
other  operating  systems,  [...] 
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user  registers  with  and  how  the  user  uses  each  website/app.  The  amount  of  data  that 
Facebook  currently  receives  is  basically  the  same  as  the  data  record  that  can  be 
captured  with  social  plugins,  since  the  Facebook  Login  is  also  implemented  via  the 
SDK.  In  addition,  further  data  is  collected.  This  includes  "Error  Information",  which 
includes  the  user  IDs  of  people  logged  into  Facebook.  According  to  Facebook,  the 
company  also  receives  the  login  information  which  users  enter  directly  and  manually  - 
without  using  the  Facebook  Login  -  on  the  website  of  the  provider  who  has  the 
Facebook  Login  embedded.120 

144  Measurement  and  analytics  tools  are  on  the  one  hand  the  SDK,  which  produces  the 
data  flows  shown  above.  The  "Facebook  pixel"  is  the  relevant  interface  that  can  be 
integrated  into  websites  for  this  very  purpose.  The  pixel  is  initially  used  to  send  the  data 
record  of  the  http  header  collected  during  the  integration  of  each  interface  to  Facebook. 
When  the  website  is  accessed,  a  standard  web  protocol  is  created  by  default  that 
includes  IP  addresses,  information  about  the  web  browser,  page  location,  document, 
referrer  (the  web  page  from  which  the  user  has  accessed  the  current  website),  and  the 
person  using  the  website.  Via  the  pixel,  Facebook  receives  pixel-specific  data, 
including  the  pixel  ID  and  the  Facebook  cookie.  Facebook  also  receives  "click  data"  for 
buttons  ("button-click  data")  by  default,  namely  any  buttons  clicked  by  site  visitors,  the 
labels  of  those  buttons  and  any  pages  visited  as  a  result  of  the  button  clicks.121 

145  In  addition,  the  website  operator  can  configure  certain  user  actions  ("Events")  regarding 
the  use  of  the  third-party  website  or  app.  In  this  case,  Facebook  receives  additional 
information  about  user  behaviour  on  Facebook.122  The  pre-configured  fifteen  "Standard 
Events"  include  information  about  a  purchase  made  on  the  website,  a  registration,  the 
placing  of  goods  in  the  shopping  cart  or  a  search  query  made  by  the  user.123  Depending 
on  the  website  operator's  wishes,  further  "event  types"  can  be  configured  in  addition  to 
these  standard  events,  for  instance  information  on  whether  the  user  has  scrolled  down 
to  the  end  of  a  page  or  how  many  articles  have  been  read  in  a  session.124 

(3)  Assignment  to  the  individual  Facebook  user  accounts 

146  The  collected  data  is  assigned  to  the  Facebook  accounts  of  the  relevant  users.  There 
are  a  number  of  ways  in  which  the  data  collected  can  be  assigned. 


120  [...] 

121  https://de-de.facebook.com/business/learn/facebook-create-ad-aDD-install-engaaement.  [...] 

122  [■■■] 

123  https://de-de.facebook.com/business/helo/402791 146561 655?heloref=faa  content:  Standard-Events:  Add  to 
cart,  Add  Payment  Infor,  Add  To  Wishlist,  Complete  Registration,  Contact,  Customize  Product,  Donate,  Find 
Location,  Initiate  Checkout,  Lead,  Purchase,  Schedule,  Search,  Start  Trial,  Submit  Application. 

124  https://develooers.facebook.com/docs/facebook-pixel/advanced,  f...1 
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147  In  the  case  of  websites,  the  cookies  stored  on  the  users'  browser  in  particular  allow 
the  observed  user  behaviour  to  be  assigned  to  the  individual  Facebook  user  account. 
Facebook  sets  cookies  on  the  browser  of  all  Internet  users  when  they  visit  a  Facebook 
domain  (such  as  www.facebook.de)  for  the  first  time.125  If  the  user  subsequently 
accesses  a  third-party  website,  the  user  browser  also  establishes  a  connection  to 
Facebook  and  Facebook  can  read  the  cookie  in  the  user's  browser.  If  Facebook 
cookies  are  stored  on  the  user’s  browser,  the  user’s  browser  transmits  additional 
information  to  Facebook  -  depending  on  what  kind  of  cookies  have  been  stored.126  In 
order  to  enable  the  data  collected,  for  instance  Facebook  pixels  to  be  assigned  to 
Facebook  user  accounts,  Facebook  transmits  the  "pixel  ID"  via  a  Facebook  cookie.127 
If  the  cookie  is  not  already  present  on  the  browser,  it  is  set  at  the  time  the  website  is 
accessed.128 

148  If  cookies  cannot  be  stored  in  the  user's  browser  -  e.g.  due  to  relevant  user  settings  - 
there  is  the  possibility  of  "Advanced  Matching”  through  the  use  of  "identifiers"  in  order 
to  assign  user  behaviour  to  Facebook  user  accounts.  This  is  where  the  third-party 
company  has  the  option  of  sending  its  own  customer  lists,  so-called  "custom  identifiers" 
to  Facebook.  The  customer  list  is  encrypted  locally  on  the  user's  browser  by  means  of 
"hashing"  and  is  then  transmitted  to  Facebook.  The  data  is  hashed  before  it  is 
transmitted.  A  so-called  "hash  value"  is  assigned  to  the  data  with  a  certain  algorithm, 
ensuring  the  data  is  no  longer  recognisable  in  plain  text  during  transmission.  According 
to  Facebook,  the  data  is  matched  with  Facebook  users,  with  the  hashed  value  being 
assigned  to  the  individuals.  This  is  possible  because  data  records  that  have  been 
hashed  using  the  same  algorithm  or  the  same  hash  function  also  have  the  same  identity 
hash  value.  Facebook  then  matches  the  transmitted  data  and  adds  the  "matched"  data 
to  the  advertiser's  custom  audience.129  According  to  Facebook,  all  hashes  sent  are 
deleted,  unless  Facebook  needs  the  data  for  fault  clearance  or  product  improvement 
purposes.130  Facebook  claims,  however,  that  these  data  records  are  not  used  to 
permanently  update  Facebook  user  data.131 

149  Cookies  are  no  longer  used  for  mobile  apps;  Facebook  identifies  the  user  via  the  SDK 
reading  the  advertising  ID  of  the  operating  system  on  the  terminal  (Identifier  for 
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Advertising  ("IDFA")  for  iOS  or  Android  Advertising  ID  ("AAID")  for  Android).  It  is 
therefore  possible  to  identify  users  without  having  to  use  an  additional  cookie.132 

1 50  Facebook  also  uses  other  metadata,  in  particular  various  device-related  data,  to  assign 
the  data  to  a  Facebook  user.133 


III.  Progress  of  the  proceedings 

151  The  Bundeskartellamt  instituted  proceedings  in  a  letter  addressed  to  Facebook  Inc., 
Facebook  Ireland  and  Facebook  Germany  on  1  March  201 6134.  As  part  of  the 
investigations,  the  Decision  Division  sent  decisions  requesting  information  to 
Facebook135  and  companies  potentially  competing  with  Facebook136.  On  14  July 
201 6137,  the  Federation  of  German  Consumer  Organisations  (Verbraucherverband 
Bundeszentrale,  VZBV)  was  invited  to  join  the  proceedings  upon  their  application  filed 
on  13  June  201 6138.  From  19  to  28  October  2016,  the  market  research  company 
Marplan/Forsa  conducted  a  consumer  survey  on  the  use  of  social  media  among  a  total 
of  1,117  consumers  on  behalf  of  the  Bundeskartellamt.139  The  Bundeskartellamt 
granted  the  parties  to  the  proceedings  access  to  the  file  on  the  results  of  the  survey.140 

152  The  Bundeskartellamt  carried  out  further  investigations  between  December  2016  and 
February  201 7  by  issuing  decisions  requesting  information  from  media  agencies141  and 
advertisers.142  In  a  letter  dated  22  May  201 7143  and  an  e-mail  dated  28  July  201 7144, 
the  Bundeskartellamt  asked  Facebook  further  questions  about  its  advertising  activities 
and  data  processing  practices. 
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153  The  Bundeskartellamt  held  talks  with  Facebook  and  its  legal  representatives  on  21 
March  201 6145,  12  May  201 6146,  25  January  201 7147,  5  April  201 7148,  14  July  201 7149 
and  7  November  201 7150.  In  addition,  it  held  talks  with  the  Federation  of  German 
Consumer  Organisations151  on  22  April  2016  and  on  12  May  2017  and  with  Hamburg’s 
Commissioner  for  Data  Protection  and  Freedom  of  Information  on  5  May  201 7152.  It 
also  held  talks  with  representatives  of  media  agencies153  and  representatives  of  Google 
Inc. 

154  Facebook  submitted  a  White  Paper  on  “Relevant  Markets  and  Lack  of  Dominance”154 
on  18  November  2016  in  which  it  essentially  states  that  Facebook  does  not  have  the 
characteristics  of  a  norm  addressee.  It  is  assumed  the  relevant  market  for  the  product 
concerned  is  a  "market  for  attention"  on  which  countless  competitors  compete  for  the 
attention  of  users  on  the  Internet  in  addition  to  Facebook.  Even  if  one  were  to  assume 
there  is  a  market  for  social  networks,  which  is  not  the  case,  it  would  at  least  include  the 
competitors  Instagram,  YouTube,  Google+,  Twitter,  Snapchat,  Pinterest,  Linkedln, 
Xing  and  StudiVZ  and  would  be  defined  as  a  global  market.  The  White  Paper  says 
Facebook  is  not  dominant  in  the  market  given  that  competitors  exert  considerable 
competitive  pressure  on  Facebook  through  technical  innovations.  It  says  switching 
costs  are  low  and  users  practice  multi-homing  on  a  large  scale  and  there  are  still  no 
significant  barriers  to  market  entry. 

155  In  a  written  observation  dated  5  May  2017,  Facebook  reiterated  its  view  that  Snapchat 
and  YouTube  should  be  considered  to  be  part  of  the  relevant  product  market.  In 
addition,  it  called  the  validity  of  the  user  survey  commissioned  by  the  Bundeskartellamt 
into  question.155 

156  In  a  letter  dated  16  October  201 7156  Facebook  commented  on  the  theory  of  harm  put 
forward  by  the  Bundeskartellamt.  It  says  this  contravenes  European  data  protection 
law,  as  it  imposes  a  higher  data  protection  standard  on  Facebook  as  the  market  leader 
than  on  other  market  players.  Also,  since  the  9th  Amendment  to  the  German 
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Competition  Act  (Gesetz  gegen  Wettbewerbsbeschrankungen  (GWB))  entered  into 
force,  the  Bundeskartellamt  had  only  been  responsible  for  sector  inquiries  in  the  area 
of  consumer  protection,  but  not  for  enforcement  of  any  other  consumer  law  provisions. 
It  claims  the  Bundeskartellamt  was  circumventing  the  statutory  requirements  for  a 
comparative  market  analysis  pursuant  to  Section  19  (2)  no.  2  GWB  if  it  bases  abusive 
terms  on  the  general  clause  of  Section  19  (1)  GWB.  It  says  there  was  no  causality 
between  the  alleged  abusive  conduct  by  Facebook  and  a  dominant  position  in  the 
market,  as  numerous  other  companies  behaved  in  a  similar  way  when  handling 
personal  data.  And  finally,  it  says  the  Bundeskartellamt  has  disregarded  an  effect- 
based  approach.  In  this  context,  Facebook  submitted  an  economic  expertise  by  Prof. 
Dr.  Haucap  (DICE  Consult  GmbH).  This  argues  that  the  combination  of  "on-Facebook 
data"  and  "off-Facebook  data"  is  efficient  as  it  improves  both  the  product  itself  and  the 
quality  of  targeted  advertising.  Furthermore,  it  says  that  intervention  by  the  cartel 
authority  strengthened  the  market  structures,  as  users  would  have  no  reason  to  switch 
to  a  competitor  if  the  dominant  company  behaved  in  a  data  protection-friendly  manner. 

157  In  a  letter  dated  19  December  2017  (“preliminary  assessment  notice”)157,  the 
Bundeskartellamt  informed  Facebook  that  based  on  its  current  assessment,  it  intended 
to  prohibit  Facebook  from  making  the  personal  use  of  the  social  network  Facebook.com 
in  its  Terms  of  Service  contingent  on  Facebook  being  able  to  amass  any  type  of  user 
information  from  Facebook-owned  services  and  programming  interfaces,  to  assign  this 
data  to  Facebook  user  accounts,  and  to  use  it  for  any  purpose  with  any  data  processing 
procedures  mentioned  in  Facebook's  Privacy  Policy.  The  Bundeskartellamt  gave 
Facebook  the  opportunity  in  the  preliminary  assessment  notice  to  submit  justifications 
for  the  data  collection  and  assignment  provided  for  in  its  Terms  of  Service. 

158  Facebook  responded  to  the  preliminary  assessment  notice  issued  by  the 
Bundeskartellamt  in  a  letter  dated  19  April  201 8158.  It  says  Facebook  is  not  dominant 
in  the  market  since  the  Bundeskartellamt  had  defined  the  market  incorrectly. 
Furthermore,  Facebook  claims  it  did  not  have  a  dominant  position  in  the  market 
because  it  faced  high  innovation-driven  competitive  pressure  and  the  Bundeskartellamt 
had  incorrectly  analysed  the  implications  of  network  effects.  It  also  says  Facebook  did 
not  engage  in  abusive  practices,  adding  that  the  Bundeskartellamt  did  not  prove  the 
conditions  necessary  for  an  abuse,  in  particular  it  did  not  take  the  conduct  of 
undertakings  in  comparable  markets  into  account  pursuant  to  Section  19  (2)  no.  2 
GWB,  nor  did  it  sufficiently  prove  the  causality  between  abusive  conduct  and  the 
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Group’s  market  position.  As  a  result,  Facebook  claims  the  Bundeskartellamt,  as  the 
competition  authority,  was  enforcing  data  protection  law  for  which  it  had  no  substantive 
competence.  In  addition,  the  letter  says  that  Facebook  was  acting  pursuant  to  German 
and  European  data  protection  law  since  users  had  given  their  effective  consent  and 
Facebook’s  data  processing  was  necessary  for  performance  of  the  contract  and  was 
justified  by  overriding  interests.  Facebook  submitted  an  economic  analysis  carried  out 
by  David  S.  Evans  on  the  subject  “Economic  Analysis  of  Exploitative  Abuse  involving 
Attention  Platforms  and  the  Implications  for  Face  book's  Use  of  Data’’  on  22  May 
2018. 159 

159  In  the  spring  of  2018,  the  Bundeskartellamt  conducted  further  investigations,  issuing 
decisions  requesting  information  from  Facebook160  and  companies  potentially 
competing  with  Facebook161.  It  engaged  in  further  discussions  with  Facebook's 
competitors  and  with  companies  in  the  advertising,  publishing  and  online  retail 
industries.  Members  of  the  case  team  have  talked  to  representatives  of  the  VZBV162  on 
5  March  2018,  representatives  of  the  Hamburg  data  protection  commissioner  on  23 
April  2018,  representatives  of  the  Federal  data  protection  commissioner  on  5  June 
2018  163  as  well  as  representatives  of  the  IDPC  on  29  November  201 8164. 

160  In  a  written  statement  dated  1  June  2018,  Facebook  announced  the  development  of  a 
new  "clear  history"  function  that  was  currently  in  the  pipeline  [...]. 165 

161  In  a  written  observation  dated  1 7  October  201 8166,  Facebook  submitted  a  commitment 
proposal  [...]. 

162  On  5  November  2018,  the  Bundeskartellamt  once  again  informed  Facebook  of  its 
antitrust  concerns  in  a  statement  of  objections  and  granted  Facebook  access  to  files. 
Facebook  responded  to  the  statement  of  objections  in  a  letter  dated  1 1  January  2019, 
elaborating  on  its  previous  submission  and  commenting  on  the  suspension  of 
immediate  enforcement  pursuant  to  Section  65  (3)  sentence  1  no.  3,  sentence  2 
GWB.167  The  Federation  of  German  Consumer  Organisations168,  Hamburg’s 
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Commissioner  for  Data  Protection  and  Freedom  of  Information169  and  the  Federal 
Commissioner  for  Data  Protection  and  Freedom  of  Information170  have  also  responded 
to  the  statement  of  objections. 
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B.  Legal  assessment 

1 63  The  use  and  implementation  of  the  terms  of  service  which  are  specified  in  the  data  and 
cookies  policies  or  comparable  contractual  documents,  as  described  in  detail  in  the 
operative  part,  constitutes  an  abuse  of  a  dominant  position  on  the  market  for  social 
networks  for  private  users  in  the  form  of  imposing  abusive  business  terms  pursuant  to 
the  general  clause  of  Section  19(1)  GWB. 

164  Facebook  is  the  addressee  of  Section  19(1)  GWB  for  private  users  on  the  national 
market  for  social  networks  due  to  its  dominant  market  position  within  the  meaning  of 
Section  18  GWB  (see  I.).  The  data  processing  conditions  specified  in  the  operative  part 
constitute  abusive  terms  within  the  meaning  of  the  general  clause  of  Section  19(1) 
GWB  as  far  as  data  processing  by  the  corporate  services  WhatsApp,  Oculus, 
Masquerade  and  Instagram  as  well  as  Facebook  Business  Tools  are  concerned.  These 
services  are  offered  as  services  separate  from  Facebook.com  (see  II.).  This  section 
applies  irrespective  of  whether  the  conduct  also  constitutes  an  abuse  pursuant  to  Art. 
102  TFEU  (see  III.). 

I.  Addressee  of  the  provisions 

165  On  the  national  social  network  market  for  private  users,  Facebook  is  the  dominant 
undertaking  within  the  meaning  of  Section  18(1)  in  conjunction  with  Section  18(3a)  and 
(3)  GWB.  It  can  be  left  open  whether  market  dominance  has  to  be  assumed  for  other 
affected  markets. 

1.  Markets  concerned 

1 66  In  the  broadest  sense,  the  conduct  affects  the  competitive  environment  of  social  media 
(see  a.).  The  national  social  network  market  for  private  users  is  affected  as  a  separate 
market  in  the  context  of  social  media  markets  (see  b.).  Generally  speaking,  the  market 
for  online  advertising  which  is  not  linked  to  search  queries  (see  c.)  is  also  affected; 
however,  the  exact  market  definition  can  be  left  open.  The  service  also  has  further 
market  sides  which  can  be  attributed  to  various  separate  markets,  which  especially 
applies  to  the  user  sides  of  the  so-called  developers  (see  d.).  Again,  the  exact  market 
definition  can  be  left  open  in  this  case. 

a.  Social  media  in  Germany 

167  With  its  services  Facebook.com,  Facebook  Messenger,  Instagram  and  WhatsApp, 
Facebook  operates  in  the  area  of  “social  media”  in  the  broadest  sense.  The  competitive 
environment  attributed  to  "social  media"  typically  comprises  various  services  (see  (1). 
For  these  proceedings,  the  Bundeskartellamt’s  Decision  Division  will  consider  the 
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company-owned  services  Facebook.com,  Facebook  Messenger,  Instagram  and 
WhatsApp  and  approx.  30  other  services  for  the  market  definition  (see  (2),  taking  into 
account  a  user  survey  which  was  previously  conducted. 

(1)  Relevant  competitive  environment 

1 68  The  terms  “social  media”  and  “social  networks”  are  vague  and  the  details  of  the  various 
definitions  of  these  terms  vary  considerably.  Basically,  the  term  “social  media”  refers  to 
all  media  used  by  internet  users  for  the  purpose  of  communication,  with  interactivity 
playing  a  key  role.  An  uncountable  multitude  of  services  is  often  summarised  by  this 
term.  Facebook  itself  states  [...]  as  its  competitors.171 

169  According  to  a  definition  by  the  German  Association  for  the  Digital  Economy 
(Bundesverband  Digitale  Wirtschaft,  bvdw)172,  social  media  are  “a  multitude  of  digital 
media  and  technologies  enabling  users  to  exchange  information  between  themselves 
and  to  design  media  contents  either  individually  or  as  a  community.  The  interactions 
include  mutual  exchanges  of  information,  opinions,  impressions  and  experiences,  and 
the  participation  in  content  creation.  Users  actively  refer  to  contents  through  comments, 
ratings  and  recommendations.  In  doing  so,  they  establish  a  social  connection  to  each 
other.  (...)“. 173  Another  definition  reads  as  follows:  “Social  media  are  internet  platforms 
on  which  users  can  build  relationships  with  other  users  and  communicate. 
Communication  does  not  merely  comprise  the  exchange  of  verbal  messages,  but  also 
involves  many  multimedia  formats  like  photos,  videos,  music  and  speech  recordings 
and  games.  The  user  community  of  such  a  social  media  platform  is  referred  to  as  a 
“ community ”.174  (Bundeskartellamt  unofficial  translation) 

170  In  the  public  discussion,  the  various  forms  of  social  media  are  classified  according  to 
various  criteria.  From  a  marketing  perspective,  for  instance,  “social  networks”  (e.g. 
Facebook,  Linkedln,  Xing,  WhatsApp  and  dating  portals)  are  differentiated  from 
“content  sharing  &  entertainment  platforms”  (e.g.  YouTube,  FlickR,  Instagram, 
Pinterest),  “knowledge  communities”  or  “blogging  platforms”  (e.g.  Twitter,  which  is  often 
classified  as  a  “microblog”),  and  “consumer  communities  (e.g.  rating  portals).175  Other 
marketing  representatives,  however,  distinguish  “social  networking”  from  “social 
sharing”.  According  to  them,  social  networking  is  offered  by  services  linking  people  with 
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172  Bundesverband  digitale  Wirtschaft,  www.bvdw.org  (last  accessed  on  8  January  2019). 

173  "Social  Media  Kompass  2017/2018"  of  the  BVDW, 

https://www.bvdw.orq/fileadmin/bvdw/upload/publikationen/social  media/kompass  social  media  2017  2018. 

pdf,  (last  accessed  on  8  January  2019),  see  glossary  on  page  80. 

174  Heymann-Reder,  Social  Media  Marketing,  2011,  p.  20. 

175  http://www.tourismuszukunft.de/2015/12/world-of-social-media-plattformen/  (last  accessed  on  8  January  2019) 
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similar  interests,  generating  opinions  of  many  people  and  enabling  users  to  get  quick 
information  on  various  topics  and  thus  benefit  from  the  knowledge  and  experience  of 
other  users,  e.g.  Facebook.com,  Twitter,  Tumblr,  Xing,  Google+,  Linkedln.  Social 
sharing  platforms,  by  contrast,  are  platforms  for  the  provision,  administration, 
description,  classification,  indexing,  linking  and  exchanging  of  multimedia  content 
between  users.  FlickR,  Instagram  and  YouTube  are  given  as  examples.176  Scientists, 
for  their  part,  sometimes  differentiate  according  to  the  intensity  of  social  presence  as 
achieved  through  the  rich  media  content  and  the  users’  self-presentation/self¬ 
disclosure.177 

171  Market  statistics  and  market  research  institutes  mostly  name  a  certain  selection  of 
major  social  media  platforms  when  talking  about  social  networks.  Among  them  are 
normally  Facebook.com,  Twitter,  Google+,  YouTube,  Instagram,  Pinterest,  Snapchat 
and/or  WhatsApp,  Tumblr,  Xing  and/or  Linkedln.178 

172  To  define  Facebook’s  competitive  environment  and  market,  the  Bundeskartellamt 
enquired  with  Facebook.com  and  other  networks,  in  particular  Google+,  Stayfriends, 
StudiVZ,  Xing,  Linkedln,  Twitter,  YouTube,  Yahoo  Messenger,  Skype,  Snapchat,  Yelp, 
Jappy,  WizeLife  and  Lokalisten.  When  asked  about  their  competitors,  these  companies 
also  named  a  few  other  close  competitors,  among  them  Vimeo,  Flickr,  Apple  Foto, 
Skype,  WhatsApp,  WeChat,  Viber,  Line,  Seniorbook  (now  WizeLife),  Stepstone, 
Indeed,  Instagram,  Pinterest,  Facebook  Messenger,  Google  Plangouts  and  Facetime. 

173  To  define  Facebook’s  market  and  major  competitor  relations,  the  Bundeskartellamt 
also  commissioned  a  representative  social  media  survey. 

1 74  The  user  survey  started  by  posing  an  open  question  regarding  the  definition  of  services 
as  “social  networks”  from  the  users’  point  of  view.  Question  4  read  as  follows:  “When  it 
comes  to  social  networks ,  which  services  do  you  use?  Please  state  all  services  you 
use,  even  if  you  rarely  use  them.” 

175  The  respondents  gave  the  following  answers: 


176  cf.  e.g.  https://webconsultinq-stuhec.com/bloq/social-media-plattformen  (last  accessed  on  10  January  2019) 

177  Kaplan/Haenlein,  Users  of  the  world,  unite!  The  challenges  and  opportunities  of  Social  Media,  Business 
Horizons  (2010)  53,  59,  62.  https://de.slideshare.net/Twittercrisis/kaolan-and-haenlein-2010-social-media  (last 
accessed  on  1 0  January  201 9). 

178  Cf.  e.g.  ARD/ZDF  online  survey  (in  German),  Mediaperspektiven  9/2016,  p.  434  -  htto://www.ard-zdf- 
onlinestudie.de/fileadmin/Onlinestudie  2016/0916  Koch  Frees.pdf  (last  accessed  on  10/01/2019). 
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Which  services  do  you  use? 

Named  at  least  one 

79% 

of  which:  Facebook 

75% 

WhatsApp 

37% 

Twitter 

15% 

Instagram 

13% 

Xing 

11% 

Linkedln 

5% 

Snapchat 

4% 

YouTube 

4% 

Googie+ 

4% 

Stayfriends 

4% 

Pinterest 

2% 

Tumblr 

2% 

Threema 

2% 

Named  no  service 

21% 

Statistical  population  n  =1041,  includes  alternative  spellings  (e.g.  FB,  whats  up,  etc.) 

176  Less  than  1 .5%  of  the  respondents  stated  the  following  services:  archive  of  our  own, 
blogger,  brieffreunde.de,  change.org,  dbna,  deviantart,  ello,  evernote,  Finya,  Flirttown, 
FutureNet,  FragMutti,  GayRomeo,  Google  Alio,  gmx.de,  grindr,  GROWLr,  Hotmail, 
ICQ,  idealo,  1-Message,  Jappy,  jodel,  kik  Messenger,  kwick,  Lovoo,  MySpace,  Nasza 
klasa,  LINE,  Lokalisten,  Microsoft  Cloud,  medium,  Moodle,  Odnoklassniki,  Periscope, 
Platinnetz,  Plaxo,  researchgate,  Signal,  Skype,  spin,  Sportstracker,  Spotify,  Steam 
Discord,  reddit,  Strngrz,  StudiVZ/MeinVZ/SchulerVZ,  stumbleupon,  Telegram 
Messenger,  Viber,  Vine,  VK,  Wattpad,  WeChat,  Weheartit,  Wer-kennt-wen, 
Wurzelwerk,  Twitch,  zazeni,  VK,  500px  und  9GAG. 

177  The  following  multiple-choice  question  referred  to  services,  which  were  shown  to  each 
respondent  in  random  order.  It  contained  the  term  “social  media”  and  read  as  follows: 
“Please  find  below  a  list  of  various  social  media  services.  Please  state  whether  you  use 
them,  and  how  frequently  you  use  them. 

Facebook 

Google+ 

Linkedln 
-  Xing 
My  Space 
Stayfriends 
WhatsApp 
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Threema 

Telegram 

-  iMessage 
YouTube 
S nape hat 
Instagram 
Twitter 
Pinterest 
Tumblr 

-  Viber 
Reddit 

Odnoklassniki.ru 

ok.ru“ 

178  The  list  of  services  is  largely  identical  with  the  list  of  most  frequently  stated  services  in 
open  questions  and  only  contains  a  few  services  more  than  previously  stated. 

(2)  Services  considered 

179  On  this  basis,  the  Bundeskartellamt  considered  in  particular  the  following  services 
besides  Facebook.com,  Facebook  Messenger  (see  para.  15  above),  Instagram  and 
WhatsApp  (see  paras.  74ff.  and  83ff.)  when  defining  the  market  as  an  environment  of 
services: 

1 80  Apple  Foto  is  a  photo  management  program  for  Mac  OS  X  (Desktop)  operating  systems 
and  the  mobile  iOS  system  by  the  US-based  company  Apple  Inc.  It  has  been  pre¬ 
installed  on  iPad  and  iPhone  devices  as  a  standard  since  2014  and  on  Macintosh 
computers  with  Mac  OS  X  since  2015.  Besides  organising,  editing  and  presentation 
functions,  Apple  Foto  also  has  a  sharing  function  enabling  bilateral  sharing  of  Fotos  via 
Mail,  the  iCIoud  cloud  service  or  wireless  sharing  via  AirDrop,  and  posting  of  pictures 
on  Twitter,  Facebook,  Linkedln,  Vimeo  and  Flickr  for  users  who  have  an  account  with 
these  services. 

181  FaceTime  was  launched  by  Apple  Inc.  in  2010.  The  service  offers  IP  telephony  and 
video  conferences  via  its  own  application  software  for  the  Apple  MacOS  and  iOS 
operating  systems.  It  is  a  standard  pre-installation  on  Macintosh  computers  and  iPad 
and  iPhone  devices. 

182  Flickr  (www.flickr.com)  has  been  available  in  Germany  since  2007.  It  is  a  service  free 
of  charge  originally  founded  by  the  US-based  company  Yahoo  Inc.  and  was  sold  to 
SlugMug  in  April  201 8. 179  Besides  photo  management,  editing  and  organisation,  Flickr 
allows  users  to  shoot  short  videos  with  a  maximum  duration  of  three  minutes,  add 
comments  and  notes  to  them,  load  them  onto  the  website  and  share  them  with  other 


179  https://www.heise.de/foto/meldung/Yahoo-verkauft-Flickr-an-SmuaMua-4028953.html  (in  German,  last 
accessed  on  1 0  January  201 9). 
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users.  Users  can  also  search  for  key  words  and  look  at  photo  streams  (photo  blogs  as 
user  profiles)  by  other  users  and  comment  on  photos  by  adding  picture  sections.  Use 
of  the  service  is  subject  to  registration.  With  their  profile,  users  can  use  the  service  both 
as  a  web-based  service  and  via  a  mobile  app  for  standard  mobile  operating  systems 
(Android  and  iOS). 

183  Google+  (www.qooqleplus.de)  was  launched  as  a  free  service  in  2011.  Friends, 
relatives  and  other  acquaintances  can  connect  via  this  platform.  Google-i-  was  also 
offered  as  part  of  the  “G-Suite”,  a  paid  service,  in  spring  2018.  The  Google+  enterprise 
version  is  part  of  a  range  of  software  and  office  applications  for  internal  company 
organisation.  Formerly  known  as  “Apps  for  work",  these  apps  are  now  part  of  the  “G 
Suite"  brand,  and  cost  between  €4  and  €23  per  employee  of  the  company.180  Within  G 
Suite,  Google+  is  supposed  to  offer  social  networking  functions  to  support  personal 
networks  within  the  company.181  Depending  on  the  settings,  the  visibility  of  contents 
can  be  limited  to  staff  members  of  the  company  or  extended  to  public  circles.  In  October 
2018  Google  announced  that  the  service  would  be  discontinued  for  private  users.182 
However,  in  assessing  the  dominant  position,  the  Bundeskartellamt  considers  the 
market  position  Google+  used  to  hold. 

184  Google  Hangouts  (www.hanqouts.qooqle.com)  is  a  service  launched  by  Google  in 
2013.  Users  who  have  a  Google  account  can  use  it  via  an  app,  a  website,  or  as  a 
function  of  Gmail,  Google+  or  Inbox.  Hangouts  allows  users  to  share  text  messages, 
photos,  videos,  stickers  or  locations  either  bilaterally  or  in  groups.  Video  conferences 
are  also  possible. 

1 85  iMessage  is  a  service  by  Apple  Inc.  for  devices  with  Apple  Mac  OS  X  and  iOS  operating 
systems.  Users  have  to  register  once  with  their  Apple  ID  or  phone  number.  It  is  a 
standard  pre-installation  on  Mac  computers  and  iPhone  and  iPad  devices.  The  service 
offers  a  bilateral  exchange  of  photos,  texts,  videos  and  other  files.  iMessage  is  linked 
to  iPhone’s  messages  app  and  starts  automatically  if  the  recipient  also  uses  an  iPhone 
and  has  it  switched  on. 

186  Indeed  (http://www.indeed.com)  is  an  online  job  search  portal  which  was  founded  in 
2004.  The  service  is  now  also  available  as  an  app  for  smartphones.  It  is  part  of  the 
Japanese  Recruit  Holdings  &  Co.  Ltd.  and  offers  a  platform  for  publishing  job  adverts 
free  of  charge  in  a  simple  version  and  subject  to  payment  in  various  premium  options. 


180  [...]  https://qsuite.qooqle.com/intl/de/pricinq.html  (last  accessed  on  10  January  2019). 

181  https://www.cloudcomputinq-insider.de/apps-fuers-business-was-ist-qooqle-q-suite-a-691517/  (in  German, 
last  accessed  on  1 0  January  201 9). 

182  https://www.blog.google/technology/safety-security/project-strobe/  (last  accessed  on  10  January  2019). 
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Companies  can  build  their  own  recruiting  sites.  Job  seekers  can  register  for  free  and 
create  and  upload  their  CVs. 

187  Jappy  (www.jappy.de)  is  a  free  contact  and  communication  service  in  Germany  which 
has  been  operated  by  Jappy  GmbH  since  2001.  To  participate,  users  need  a  user 
profile  containing  basic  data  like  user  name,  place  of  residence,  age  and  sex.  They  can 
add  further  data  (occupation,  relationship  status,  name,  etc.)  or  pictures  and  share  it 
with  other  users  if  they  wish  to.  Users  can  befriend  other  users  or  subscribe  to  the 
contents  of  other  users.  Unwanted  contacts  can  be  blocked  via  contact  filters  or 
blocking  functions.  Users  find  other  users  via  the  exploration  system  (public  status 
messages  suggested  by  the  system),  the  recommendation  system  (“People  you  may 
know”)  or  active  research  via  the  user  search  function.  Communication  can  take  various 
forms,  e.g.  chats,  status  messages,  guestbook  entries,  group  forums,  comments,  and 
feedback  icons.  Users  are  rewarded  for  their  activity  on  the  platform  and  receive  a 
credit  voucher  depending  on  their  rank  every  Sunday.  A  member’s  rank  will  rise  and 
fall  according  to  his  activity.  With  these  credits,  users  can  make  virtual  gifts  or  share 
emoticons  or  unlock  further  functions  (e.g.  new  status  pictures,  new  emoticons). 
Additionally,  every  member  can  activate  a  flirting  option.  Jappy  is  financed  through 
advertising  and  offers  targeted  advertising  services. 

188  Lokalisten  was  a  service  provided  by  Unterfohring-based  Lokalisten  Media  GmbH, 
which  was  majority-owned  by  ProSiebenSat.1  Media.  The  focus  of  this  service  was  to 
connect  users  from  the  same  region.  Founded  in  2005,  the  service  was  discontinued 
in  September  201 6  after  a  significant  amount  of  members  had  left  the  platform.  For  this 
reason,  the  service  is  no  longer  taken  into  account  when  defining  the  market. 

189  Line  is  a  free  service  provided  by  the  Japanese  Line  Corporation  (Tokyo),  which 
belongs  to  the  Korean  Naver  Corporation  (Seongnam).  The  service  has  been  on  the 
market  since  2011.  The  mobile  app  is  available  in  several  languages  and  for  various 
operating  systems.  Users  can  make  voice  and  video  calls  and  send  text  messages. 
The  app  has  a  timeline  function  to  communicate  with  friends  through  texts,  pictures, 
films,  stickers  and  other  message  forms. 

1 90  Linkedln  (www.linkedin.com)  is  operated  by  the  US-based  company  Linkedln  Inc.  and 
has  been  owned  by  Microsoft  Corp.  since  December  2016.  Since  2003,  Linkedln  has 
been  offering  an  international  online  platform  for  maintaining  existing  business  contacts 
and  making  new  ones.  Most  functions  of  the  platform  are  fee-based.  The  service  is 
available  via  the  web  or  a  mobile  app.  Its  focus  is  on  creating  a  professional  online 
identity  and  linking  in  with  other  users  and  companies  for  career  development  and 
training  opportunities.  Personal  and  corporate  profiles  can  be  created  in  several 
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languages.  Users  can  make  new  contacts  and  recommend  other  members.  They  can 
also  enter  links  to  their  own  websites  and  found  or  become  members  of  groups  for 
certain  topics.  The  company  also  offers  search  and  recruiting  tools.  A  premium 
membership  costs  between  €26  and  €90  per  month.  The  free  standard  account  offers 
some  basic  functions  for  setting  up  a  profile  and  receiving  messages. 

191  MySpace  (www.myspace.com)  is  a  service  of  the  US  advertising  company  Specific 
Media  Inc.,  which  acquired  the  service  from  the  US-based  News  Corp.  media  group  in 
201 1 .  MySpace  has  been  on  the  market  since  2003  and  has  been  available  in  Germany 
since  2007.  It  was  relaunched  in  2012.  Users  had  to  re-register  as  a  result.  MySpace 
is  a  free  multilingual  service  offering  its  users  to  set  up  profiles  containing  photos, 
videos,  blogs,  groups,  lists  of  friends,  etc.  The  service  has  a  clear  focus  on  music  and 
was  originally  also  created  for  unknown  artists  and  bands  enabling  them  to  reach  a 
potential  audience.  The  musicians  published  information  about  new  albums  and  tour 
dates.  Most  bands  also  offered  audio  samples  of  their  music.  Additionally,  users  can 
create  individual  sites  to  provide  information  on  themselves.  The  service  is  available 
via  the  web  or  a  mobile  app  for  the  standard  operating  systems. 

192  Odnoklassniki  (English:  classmates,  www.ok.ru)  is  a  Russian  service  of  the  Russian 
Mail.Ru  Group  investment  company  and  was  launched  in  2006.  Users  can  set  up 
profiles  in  various  eastern  European  languages  and  in  English  free  of  charge.  Profiles 
can  contain  various  pieces  of  personal  information  as  well  as  photos,  lists  of  friends, 
groups,  forums,  etc.  They  can  look  for  friends  and  make  contact  with  other  members. 
Schools  from  all  over  the  world  can  be  entered.  Users  can  play  online  games  together, 
link  YouTube  videos  and  listen  to  music  for  free. 

1 93  Pinterest  (www.pinterest.com)  is  a  service  of  the  US  company  Pinterest  Inc.,  Palo  Alto, 
which  was  launched  in  2010  and  describes  itself  as  a  “catalogue  of  ideas  people  use 
to  plan  the  big  and  small  projects  of  their  lives”.  Besides  pictures  on  various  topics  (e.g. 
cooking,  travel,  beauty),  users  can  find  additional  information  (e.g.  the  provider’s  e-mail 
address).  Users  have  to  register.  Their  profile  allows  them  to  create  their  own  contents 
by  creating  their  own  “boards”  to  post  “pins”  on.  The  standard  privacy  setting  for 
pictures  is  “public”.  However,  users  can  create  “secret  boards”  for  their  own  use  only. 
Users  can  “follow”  other  users  and  generate  “followers”  themselves.  The  service  is 
available  via  the  web  or  a  mobile  app  for  the  standard  operating  systems. 

194  Reddit  (www.reddit.com)  is  a  mostly  English-language  service  provided  by  the  US- 
based  Reddit  Inc.  It  was  launched  in  2005  and  is  used  for  exchanging  news.  Users 
have  to  register.  With  their  profile,  they  can  post  external  links  or  their  own  postings  on 
Reddit.  Postings  the  users  create  themselves  contain  texts  on  selected  topics.  Other 
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users  can  comment  and  vote  on  their  postings.  Authors  receive  rating  points  for 
postings  or  comments  which  other  users  rate  as  positive.  The  service  is  available  via 
the  web  or  a  mobile  app  for  the  standard  operating  systems. 

195  Skype  (www.skype.com)  is  a  service  launched  in  2003.  It  was  purchased  by  Microsoft 
Corp.  in  2011.  Skype  customers  can  use  the  service  to  make  free  phone  calls  on 
Skype.  Phone  calls  to  landline  or  mobile  phone  numbers  (“skype  out”)  can  be  made  for 
a  fee.  Skype  supports  videoconferences  and  exchanges  of  text  messages  and  other 
files.183  The  service  is  available  via  the  web  or  a  mobile  app  for  the  standard  operating 
systems. 

1 96  Snapchat  is  a  service  of  the  US-based  company  Snap  Inc.  and  was  launched  in  2012. 
The  service  offers  a  mobile  app  for  smartphones  enabling  users  to  send  photos  and 
videos  (“snaps”)  to  friends  free  of  charge.  The  pictures  and  videos  are  only  visible  for 
a  limited  amount  of  time.  Photos  and  videos  can  be  edited  with  filters  and  stickers. 
Users  register  with  a  simple  profile.  Only  contacts  specified  by  user  name  or  snap  code, 
or  users  from  the  address  book  can  be  searched  and  found.  Individual  snaps  can  be 
joined  together  in  an  album  which  is  called  a  “story”.  A  story  can  contain  photos,  videos 
and  pictures  and  is  visible  to  friends  for  up  to  24  hours.  Users  can  also  save  snaps  in 
their  “memories”  to  be  able  to  access  them  on  a  permanent  basis. 

1 97  Stayfriends,  (www.stavfriends.de)  is  a  service  available  under  that  name  in  Germany, 
Austria,  Switzerland,  and  Sweden.  In  France,  it  is  known  as  Trombi  (www.trombi.com). 
It  was  launched  in  2000  and  acquired  by  Stroer  SE  &  Co.  KGaA  in  2016.  The  service 
helps  users  find  former  classmates  and  offers  a  virtual  space  for  users  to  reconnect 
with  people  they  knew  at  school,  assemble  memories  and  photos  and  stay  in  touch 
with  these  people.184  Users  set  up  their  profiles  and  lists  of  contacts  and  contact  others 
bilaterally  via  an  integrated  messenger  service.  The  service  is  offered  as  a  “freemium” 
service,  i.e.  a  basic  version  of  it  is  free  while  additional  services  or  the  whole  service 
package  are  available  for  a  fee.  Most  functionalities  of  StayFriends  are  only  available 
for  gold  members  who  pay  an  annual  fee  of  approx.  €30. 

198  Stepstone  (www.stepstone.de)  was  launched  in  1996  and  known  as  “Jobshop”  until 
2000.  It  has  been  owned  by  Axel  Springer  SE  since  2008.  The  service  offers  an  online 
job  market  for  experts  and  leaders.  Companies  can  post  job  adverts  for  a  fee.  Posting 


183  [...] 
184  [...] 


55 


a  job  advert  for  30  days  costs  between  €900  and  €1 700. 185  The  service  is  available  free 
of  charge  for  job  seekers.  The  site  offers  various  search  filters  for  job  adverts. 

199  StudiVZ  (www.studivz.de)  is  a  German  portal  financed  through  advertising.  It  was 
founded  as  a  subsidiary  of  the  Holtzbrinck  publishing  house  in  2005  and  designed  as 
an  online  community  for  students.  Related  platforms,  SchulerVZ  (for  pupils)  and 
MeinVZ  (general  social  network)  were  founded  in  2007  and  2008,  respectively,  to  reach 
further  target  groups.  The  services  expanded  to  other  European  countries.  The  service 
has  focused  on  the  German  market  since  2009  and  now  belongs  to  Poolworks 
(Germany)  Ltd.  SchulerVZ  was  discontinued  in  2013.  While  Poolworks  disclosed  its 
bankruptcy  in  September  2017,  the  services  StudiVZ  and  MeinVZ  are  to  stay  in 
business.186  The  service  offers  users  to  connect  with  each  other  free  of  charge  by 
setting  up  a  profile  which  can  contain  various  pieces  of  information.  They  can  search 
other  students  and  see  links  to  other  contacts.  Users  can  form  discussion  groups, 
create  “photo  albums”  and  upload  photos.  Its  functions  include  a  chat  function  called 
“Plauderkasten”,  a  video  series  and  a  messaging  function  called  “Buschfunk”.  The 
service  is  available  as  a  web  service  and  as  a  mobile  app  for  standard  operating 
systems. 

200  Telegram  (www.teleqram.org)  was  founded  in  201 3  by  the  Russian  entrepreneur  Pavel 
Durov,  who  also  used  to  own  the  popular  Russian  social  network  vk.ru  which  has  been 
taken  over  by  the  Mail.ru  Group  in  the  meantime.  Telegram’s  affiliation  is  unclear.  The 
providers  Telegram  Messenger  LLP,  Telegram  LLP,  Telegram  LLC  or  Digital  Fortress 
LLC  are  stated  as  the  providers  in  app  stores.  All  of  them  are  considered  phantom 
companies  and  associated  with  various  offshore  companies.187  The  service  is  available 
free  of  charge  as  a  web  service,  PC  application  software,  and  as  a  mobile  app  for 
various  operating  systems.  Users  can  exchange  text  messages,  encrypted  messages, 
photos,  videos  and  documents.  They  can  define  a  period  of  time  after  which  the  end- 
to-end  encrypted  “Secret  Chats”  disappear  automatically  (messages  and  media). 
Several  people  can  chat  simultaneously  about  a  certain  topic  via  public  and  private 
“channels”  without  their  names  appearing  as  authors  of  the  messages. 

201  Threema  (www.threema.ch)  is  a  service  based  in  Switzerland,  which  is  operated  by 
Threema  GmbH  and  was  launched  in  201 2.  Via  the  service,  users  can  exchange  texts, 
videos  and  voice  messages.  It  also  offers  group  functions,  surveys,  and  a  voting 


185  https://www.stepstone.de/content/de/de/downloads/StepStone  Produkte&Preise.pdf  (in  German,  last 
accessed  on  1 0  January  201 9). 

186  https://www.heise.de/newsticker/melduna/StudiVZ-Betreiber-Poolworks-ist-insolvent-3825444.html  (last 

accessed  on  1 0  January  201 9). 

187  Cf.  e.g.  https://www.gruenderszene.de/allaemein/telearam-berlin-oder-nicht  (available  in  German  only,  last 
accessed  on  1 0  January  201 9). 
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function.  The  service  can  be  used  with  a  payable  smartphone  app,  but  it  is  also 
available  as  a  desktop  version. 

202  Tumblr  (www.tumblr.com)  was  launched  in  2007.  It  is  a  mostly  English  language 
service  provided  by  the  US-based  Tumblr  Inc.,  which  was  acquired  by  Yahoo  Inc.  in 
2013.  The  service  is  available  as  a  smartphone  app  and  as  a  web  application.  Upon 
registration,  Tumblr  users  automatically  get  their  own  blog.  A  blog  can  be  filled  with 
various  content  formats  (photos,  GIFs,  links,  Spotify  tracks,  MP3s,  videos,  etc.).  Users 
can  design  their  blog  individually  and  operate  several  blogs  simultaneously.  Tumblr 
blogs  are  always  public.  In  their  “Tumblr  Backend”,  users  can  see  the  blogs  they 
subscribed  to.  Tumblr  does  not  have  a  comments  section.  Users  interact  with  other 
users  by  tagging  them  as  “favorite”  and  by  “reblogging”  posts  (i.e.  posting  them  in  their 
own  blog  with  a  link  to  the  original  source).  Blogs  can  include  a  hashtag  (#)  to  make 
sure  they  can  be  found  via  the  search  function. 

203  Twitter  (www.twitter.com)  is  an  international  service  by  the  US  company  Twitter  Inc., 
which  was  launched  in  2006.  Users  can  post  telegram-style  short  messages  of  a 
maximum  length  of  280  characters  (“tweets”)  for  free.  The  service  is  therefore  often 
categorised  as  a  “microblogging”  service.188  Tweets  can  also  include  photos  and 
videos.189  Users  can  link  individual  words  in  a  tweet  using  the  hashtag  (#)  symbol.  Other 
users  can  share  (“re-tweet”)  a  user’s  tweet  and  subscribe  to  a  user’s  content  by 
becoming  his  “follower”.  They  will  see  a  chronological  list  of  tweets  by  users  they  follow. 
All  users  must  register  and  can  set  up  a  user  profile.  Twitter  is  available  via  the  web  or 
a  mobile  app  for  the  standard  operating  systems. 

204  Viber  is  a  service  of  Viber  Media  S.a.r.l.  Founded  in  2010,  it  has  belonged  to  the 
Japanese  Rakuten  K.K.  company  since  2014.  The  service  offers  IP  telephony  services 
in  particular.  For  this  purpose,  Viber  does  not  require  user  names.  Instead,  it  uses  the 
available  mobile  phone  numbers.  The  service  is  only  available  to  users  who  have  the 
corresponding  Viber  software,  either  as  a  mobile  app  or  on  their  desktop  computer. 
With  Viber,  users  can  also  send  text  messages,  photos,  videos  and  locations.190 

205  Vimeo  (www.vimeo.com)  is  a  video  portal  of  the  US-based  InterActive  Corp.,  which 
was  launched  in  2004.  Vimeo  is  considered  a  portal  for  professionals  offering  a 
“freemium”  model.  Its  main  target  group  are  film  makers.  Other  than  artistic  videos, 
there  are  also  many  professionally  produced  video  tutorials  and  online  courses,  which 


188  http://www.faz.net/aktuell/feuilleton/twitter-hebt-das-zeichenlimit-auf-15221037.html  (in  German,  last  accessed 
on  10  January  2019). 

189  http://www.spieqel.de/netzwelt/web/twitter-erlaubt-etwas-mehr-als-1 40-zeichen-a-1 1 1 2992.html  (in  German, 
last  accessed  on  10  January  2019). 

190  http://www.viber.com/about  (last  accessed  on  1 0  January  201 9). 
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can  only  be  viewed  for  a  fee.  Users  exclusively  wishing  to  use  Vimeo  for  looking  at 
videos  do  not  need  to  register.  To  actively  use  the  portal,  a  registration  including  the 
name,  e-mail  address  and  a  password  is  necessary.  A  user  profile  can  contain 
additional  information  on  the  users’  CV  or  places  of  residence.  Users  can  also  upload 
a  profile  picture.  Vimeo’s  basic  version  is  free.  The  basic  version  contains  advertising 
banners  and  has  a  data  limit  for  video  uploads.  Vimeo's  Plus  membership  (approx.  €50 
per  year)  and  Pro  account  (approx.  €160  per  year)  do  not  display  advertisements. 
Users  have  to  produce  the  content  they  upload  themselves,  at  least  to  a  significant 
extent,  i.e.  users  have  to  be  the  creators  of  any  video  they  upload.  As  a  general  rule, 
the  content  must  not  contain  advertisements.  Users  can  set  up  their  own  channels  and 
blogs,  join  groups  on  certain  topics  and  subscribe  to  channels  of  others  and  comment 
on  them. 

206  WeChat  is  a  free  Chinese  service  operated  by  the  Chinese  company  Tencent  since 
2011,  which  is  also  used  by  international  users.  WeChat  serves  to  share  audio  and 
video  files.  It  also  contains  further  functions,  e.g.  for  ordering  taxis,  groceries  or  food 
and  paying  via  a  payment  function.191  The  app  has  its  own  app  store.  Users  can  look 
for  people  near  them,  play  games,  buy  stickers,  pay  their  restaurant  and  electricity  bills, 
look  for  a  job,  book  doctor’s  appointments  or  operate  their  own  mobile  stores. 

207  WizeLife  (formerly:  “Seniorbook”,  www.wize.life)  is  an  advertising-funded  service 
which  was  launched  in  2012  and  is  operated  by  Munich-based  Seniorbook  AG.  The 
service  addresses  users  aged  40  or  older  and  is  an  online  contact  and  communication 
service  for  exchanging  experiences  and  meeting  people  with  shared  or  similar 
interests.  Users  can  enter  a  detailed  profile  on  WizeLife  or  the  mobile  app.  The  service 
recommends  using  the  real  name  and  place  of  residence  for  that  purpose.  By  entering 
topics,  using  the  chat  function  and  entering  counties/places  in  which  the  members  live, 
they  can  find  like-minded  people  online  and  meet  them  in  person  too.  Members  can 
communicate  via  local  groups,  get  information  on  events  or  make  appointments. 

208  Xing  (www.xinq.com/en)  is  operated  by  Xing  AG  and  majority-owned  by  Burda  Digital 
GmbH  in  Hamburg,  which  is  a  subsidiary  of  Hubert  Burda  Media  Holding  KG  in 
Offenburg.  The  company’s  online  service  for  making  and  maintaining  business 
contacts  has  been  available  in  Germany,  Austria  and  Switzerland  from  different 
websites  since  2003  (initially  under  the  name  OpenBC),  mostly  for  a  fee.192  Users  can 
develop  a  professional  network,  find  job  adverts  matching  their  profile  and  information 
relevant  to  their  industry  or  profession  to  keep  up  to  speed  with  developments  in  their 

191  https://web.archive.org/web/201 603101 60456/http://www.diqitalkompakt.de/uebersicht/wechat-messenqer/  (in 

German,  last  accessed  on  1 0  January  201 9). 
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professional  lives.193  Membership  is  subject  to  registration.  The  (basic)  membership  is 
available  free  of  charge  and  offers  very  limited  functionalities  compared  to  the  premium 
membership  which  is  available  for  a  fee.  Users  can  set  up  a  detailed  profile  containing 
both  professional  and  private  information.  The  profile  includes  an  overview  of  a  user’s 
degree,  vocational  training  and  career  path,  similar  to  a  CV.  Users  can  stay  in  touch, 
use  XING’s  public  event  calendar  and  an  appointment  function.  A  multitude  of 
discussion  fora  is  available,  some  of  which  are  public,  and  some  of  which  are  only 
accessible  for  a  limited  circle  of  users.  In  addition  to  the  online  offer,  users  can  join 
regional  groups  organising  local  meetings  for  personal  contacts. 

209  US-based  Yahoo  Inc.  had  offered  Yahoo  Messenger  as  a  service  free  of  charge  since 
1998,  which  could  be  used  as  an  app  or  as  a  function  of  the  YahoolMail  service  as  a 
desktop  version.194  The  service  has  been  discontinued  since  17  July  201 8195  and  is 
therefore  not  taken  into  account  for  this  assessment. 

210  Yelp  (www.velp.com)  has  been  on  the  market  since  2004  and  belongs  to  the  US-based 
company  Yelp  Inc.  It  is  a  review  and  recommendation  portal  for  restaurants  and  shops 
which  focuses  on  reviews  entered  by  users.  Users  can  enter  a  postcode  and  a  key 
word  and  look  for  regional  suppliers  from  various  categories  (e.g.  food  and  drink, 
shopping,  beauty,  healthcare  and  doctors).  They  can  also  review  services,  add  their 
own  photos  or  share  entries  with  other  users.  To  do  so,  they  have  to  register  and  create 
a  user  profile.  Finally,  the  platform  also  allows  users  to  book  a  table  at  a  restaurant  or 
to  buy  a  gift  voucher.196  The  service  is  available  via  the  web  or  a  mobile  app  for  the 
standard  operating  systems. 

21 1  YouTube  (www.youtube.com)  is  a  video  portal  founded  in  2005  by  YouT ube,  LLC,  San 
Bruno/USA,  which  was  acquired  by  Google  Inc.,  Mountainview/USA  in  2006.  The  portal 
is  available  as  a  web  service  or  app  for  all  standard  operating  systems,  and  as  an  app 
for  smart  TVs.  Users  can  upload  their  own  videos  to  this  platform  and  set  up  their  own 
“channel”  containing  a  playlist  of  all  videos  a  particular  user  has  uploaded.  They  can 
select  an  individual  design  for  their  channel,  e.g.  by  changing  the  title  image,  the 
channel  title,  or  by  adding  or  deleting  modules  like  playlists.  Other  users  can  view  the 
videos  and  subscribe  to  channels.  They  can  comment  and  rate  individual  videos.  While 
YouTube  can  be  used  without  registration,  its  use  is  then  restricted  to  viewing  videos. 
The  service  is  financed  through  advertising.  Advertising  is  in  most  cases  part  of  the 
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accessed  on  1 0  January  201 9). 
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videos  themselves  (“in-stream  ads”),  displayed  as  so-called  “pre  rolls”  prior  to  starting 
the  video  or  as  “mid  rolls”  while  the  video  is  playing.  The  channel  has  to  be  made  a 
member  of  the  YouT ube  partner  program  if  it  is  to  contain  advertisements.  Since  spring 
2017,  membership  of  the  YouTube  partner  program  is  conditional  on  the  channel 
having  10,000  views.  Further  ads  are  displayed  next  to  the  running  video  and  in  the 
search  results.  The  advertisements  are  targeted  and  matched  individually  based  on  the 
videos  the  user  has  previously  watched,  according  to  YouTube.  The  interests  and 
advertising  settings  of  registered  users  are  considered.  Once  a  user  is  registered,  the 
apps  on  his/her  device  and  the  way  these  are  used,  the  websites  visited,  the  linked 
mobile  device  ID,  geo  data,  age,  sex  and  previous  interaction  with  videos  and  Google 
adverts  are  evaluated. 

b.  National  market  for  social  networks 

212  Facebook’s  activities  for  private  users  take  place  on  the  national  market  for  social 
networks.  As  a  network  and  market  side  of  a  multi-sided  market  within  the  meaning  of 
Section  18(3a)  GWB  (see  1),  the  service  Facebook.com  is  attributable  to  a  separate 
social  network  market  as  a  submarket  of  social  media  (see  1),  which  is  defined  as 
national  (see  3). 

(1)  Network  and  multi-sided  market  pursuant  to  Section  18(3a)  GWB 

213  With  its  service  Facebook.com  Facebook  offers  an  intermediary  product  by  way  of  its 
service  content,  which  is  a  combination  of  a  network  and  a  multi-sided  market  pursuant 
to  Section  18(3a)  GWB. 

(a)  Core  product:  Advertising-financed  network 

214  The  product  Facebook.com  is  a  network  financed  through  targeted  advertising,  which 
forms  a  multi-sided  market  as  a  result. 

215  Network  effects  and  its  intermediary  function  as  a  product  definition  are  particularly 
relevant  when  it  comes  to  defining  the  market.  Typically,  multi-sided  markets  are  thus 
services  facilitating,  as  intermediaries,  direct  interaction  between  two  or  more  user 
groups  between  which  network  effects  exist.197  Networks  are  thus  typically  companies 


197  Legislative  intent  on  the  9th  amendment  to  the  German  Competition  Act  (GWB),  Bundestag  printed  paper 
18/10207,  p.  49.  For  a  detailed  definition  of  platforms,  see  BKartA  Working  paper  on  the  market  power  of 
platforms  and  networks  (“Arbeitspapier  Marktmacht  von  Plattformen  und  Netzwerke”),  June  2016,  p.  8  ff. 
downloadable  from  https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Berichte/Think-Tank-Bericht- 
Lanofassung.pdf?  blob=publicationFile&v=2\  examples  from  relevant  literature  include:  Caillaud/Jullien , 
“Chicken  &  egg:  competition  among  intermediation  service  providers"  RAND  Journal  of  Economics,  2003, 
34(2),  309-328;  Armstrong,  “Competition  in  two-sided  markets",  RAND  Journal  of  Economics,  2006,  37(3), 
668-691 ;  Rochet/Tirole,  “Two-sided  markets:  a  progress  report",  RAND  Journal  of  Economics,  2006,  37(3),  S. 
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acting  as  intermediaries  providing  services  that  enable  interaction  between  users  of  the 
same  group,  which  results  in  the  creation  of  direct  network  effects.198  However,  it  is  not 
always  possible  to  strictly  separate  both  forms  of  intermediation  services,  as  is  also 
shown  by  the  present  case.  In  practice,  business  models  often  combine  platform  and 
network  elements. 

216  Key  user  groups  include  mostly  private  users,  who  use  Facebook.com  without  any 
monetary  payment,  and  advertisers  who  pay  a  fee  to  place  targeted  advertisements 
based  on  the  users'  data  on  user  websites  or  in  the  Facebook  app. 

217  For  private  users,  Facebook. corn’s  main  service  is  to  offer  functions  for  finding  friends 
and  acquaintances  and  for  sharing  various  types  of  content  in  specifically  defined 
private  user  groups,  as  is  outlined  under  para.  19ff.  above.  As  Facebook  acts  as  an 
intermediary  by  enabling  interactions  between  its  users  and  positive  direct  network 
effects  occur  within  the  private  user  group,  the  service  constitutes  a  network  within  the 
meaning  of  Section  18(3a)  GWB.  Direct  network  effects  exist  where  members  of  a 
group  directly  benefit  from  either  a  higher  (positive  direct  network  effects)  or  a  lower 
(negative  direct  network  effects)  representation  of  members  of  their  group  on  the 
platform.199 

218  The  group  of  Facebook.com  users  directly  benefits  from  more  members  using 
Facebook.com  because  of  effects  occurring  between  the  individual  private  users  within 
a  group.  The  connection  between  the  users  that  leads  to  the  network  effects  can  be 
both  direct  and  indirect.  Social  networks  are  mainly  characterised  by  direct  network 
effects  developing  between  their  members.  They  primarily  serve  to  connect  friends  and 
acquaintances  and  to  enable  communication  between  them.  The  more  private  users 
are  active  on  Facebook.com,  the  higher  the  benefits  for  this  user  group  as  the  options 
for  users  to  interact  and  find  friends  and  acquaintances  increase  with  an  increasing 
number  of  users  in  the  social  network.  The  network  effects  are  “identity-based”  because 
the  users’  identity  rather  than  just  the  number  of  users  is  relevant  in  this  context. 

219  Facebook.com  offers  the  scope,  attention  and  data  generated  by  its  private  end 
consumers  and  the  advertising  space  available  within  the  service  as  a  key  service  to 


645-667.  Hagiu/Wright,  “Multi-sided  platforms",  Working  Paper,  2015,  Harvard  Business  School, 
http://www.hbs.edU/facultv/Publication%20Files/1 5-037  cb5afe51  -61 50-4be9-ace2-39c6a8ace6d4.pdf.  (last 

accessed  on  10  January  2019). 

198  Working  paper,  government  reasoning  and  literature:  Cf.  for  example  Katz/Shapiro,  “Network  Externalities, 
Competition,  and  Compatibility",  The  American  Economic  Review,  1985,  75(3),  p.  424-440;  Farrell/Saloner, 
“Standardization,  Compatibility,  and  Innovation",  The  RAND  Journal  of  Economics,  1985,  16(1),  p.  70-83;  Shy, 
“A  Short  Survey  of  Network  Economics",  Review  of  Industrial  Organization,  201 1 , 38,  p.  1 1 9-1 49. 

199  see  also:  Bundeskartellamt,  working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016,  p.  9  ff., 
downloadable  from  https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Berichte/Think-Tank-Bericht- 
Langfassunq.pdf?  blob=publicationFile&v=2  (last  accessed  on  10  January  2019). 
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advertisers.  The  company’s  offer  is  financed  through  advertising  and  thus  constitutes 
a  multi-sided  market  pursuant  to  Section  18(3a)  GWB,  because  Facebook  acts  as  an 
intermediary  facilitating  the  direct  interaction  between  advertisers  and  private  users 
between  whom  indirect  network  effects  exist. 

220  Based  on  the  user  data  and  the  users’  awareness  while  using  the  social  network,  users 
and  advertisers  can  directly  interact  via  Facebook,  e.g.  when  following  up  the  users’ 
response  to  an  advertisement  (by  clicking  on  the  advertisement,  for  example).  As  the 
platform  provides  advertisers  with  an  audience,  i.e.  its  other  user  group,  it  can  be 
referred  to  as  an  audience  providing  platform.200  As  a  result,  indirect  network  effects 
occur  between  the  group  of  private  users  and  the  group  of  advertisers.  Indirect  network 
effects  exist  where  the  benefit  or  gain  of  users  in  one  group  depends  on  the  number  of 
users  from  another  group.  Looking  at  the  effects,  it  makes  sense  to  differentiate 
between  cases  where  the  members  of  one  user  group  benefit  whenever  the 
membership  of  the  other  group  on  the  platform  increases  (positive  indirect  network 
effects),  and  cases  where  they  benefit  whenever  the  other  group’s  membership  is 
smaller  (negative  indirect  network  effects).201 

221  Audience  providing  platforms  like  Facebook.com  typically  show  intensive  positive 
indirect  network  effects  for  advertisers.  The  benefits  of  a  social  network  for  advertisers 
increase  with  an  increasing  number  of  users.  The  larger  the  group  of  users  in  the  right 
target  group,  the  more  sales  opportunities  exist  for  an  advertiser.  With  its  many  users, 
Facebook.com  represents  a  large  number  of  different  target  groups.  Flowever,  the  two 
sides  have  different  notions  of  the  desirability  of  an  interaction  between  the  advertiser 
and  the  user  and  of  being  provided  with  an  audience  or  being  the  audience, 
respectively.  The  indirect  network  effects  are  thus  less  positive  or  even  negative. 
Private  users  of  a  social  network  typically  want  to  use  the  network  functionalities  and 
either  merely  accept  targeted  advertising  or  even  find  it  annoying.  The  benefits  for 
users  of  social  networks  do  not  increase  with  an  increasing  amount  of  (targeted) 
advertising  to  an  extent  that  would  be  comparable  to  the  benefits  of  a  large  user  base 
for  advertisers.  This  statement  is  supported  by  the  outcome  of  a  user  survey  according 
to  which  the  large  majority  of  users  consider  targeted  advertising  either  as  negative  or 
as  neutral.202 

222  Graphically,  the  core  platform  can  be  illustrated  as  follows: 


200  Cf.  BKartA,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016,  p.  24f. 

201  Cf.  BKartA,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016,  p.  9f. 
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(b)  Further  market  sides 

223  With  the  social  network  functions  for  publishers  (cf.  para.  32)  above)  and  the  developer 
platform  (cf.  para.  150  ff.  above),  Facebook  has  added  further  market  sides  to  its  core 
product  of  an  advertising-financed  network,  which  are  also  part  of  the  multi-sided 
market  from  an  economic  point  of  view. 

224  Publishers  use  Facebook. corn’s  social  network,  as  described,  to  make  their  own 
company  or  business  known  among  Facebook  users  by  creating  a  page  in  the  network. 
On  their  Facebook  pages,  operators  can  publish  their  editorial  content,  connect  with 
users,  monetise  their  websites  and  gather  information  on  user  behaviour.203 

225  Again,  Facebook  acts  as  an  intermediary  between  private  users  and  publishers  to 
facilitate  direct  contact  via  the  social  network.  Indirect  network  effects  exist  between 
the  user  groups  of  publishers  and  private  users  with  regard  to  the  marketing  purpose. 
On  Facebook.com,  commercial  site  operators  benefit  from  an  increased  scope  and 
higher  awareness  due  to  the  growth  of  the  private  user  group. 


203  [■  ] 
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226  For  developers,  Facebook  offers,  as  described  above,  the  opportunity  to  integrate  their 
web-based  offers  (websites  or  apps)  into  Facebook.com  to  increase  their  user  base 
and  to  monetise  their  service. 

227  The  products  of  Facebook’s  developer  platform  (of.  para.  150ff.  above)  have  to  be 
considered  multi-sided  markets  or  market  sides  added  to  the  social  network  as  an 
audience  providing  platform.  Customers  of  the  developer  platform  and  the  Facebook 
Business  Tools  use  Facebook’s  large  scope  and  its  database  to  pursue  the  objectives 
they  set  out  to  achieve  when  integrating  the  tools.  Facebook  thus  acts  as  an 
intermediary  again  when  it  comes  to  the  tools,  as  it  facilitates  direct  interaction  between 
private  users  and  developers.  Depending  on  what  the  interfaces  allow,  various  types 
of  interactions  can  take  place.  Developers  of  Facebook  apps  can  use  Facebook  as  an 
interface,  e.g.  to  make  their  apps  available  for  use  to  Facebook  users.  Users  of  social 
plug-ins  can  share  contents  on  Facebook.com  by  clicking  the  “Share”  or  “Like”  buttons 
on  the  developer’s  website. 

228  Indirect  network  effects  exist  between  developers  and  private  users;  their  exact  nature 
depends  on  the  respective  tool.  The  developers’  benefits  always  increase  with  a 
growing  number  of  private  users  in  the  social  network.  Conversely,  positive  indirect 
network  effects  exist  for  a  large  number  of  products,  e.g.  the  tools  for  developing 
Facebook  apps.  The  social  network’s  attractiveness  for  private  users  increases  with  a 
growing  number  of  apps.  As  far  as  other  interfaces,  e.g.  the  Marketing  API,  are 
concerned,  the  benefits  for  private  users  of  a  growing  number  of  developers  using  them 
are  less  pronounced,  which  is  similar  in  the  case  of  advertisers. 

229  Taking  these  sides  into  account,  Facebook’s  role  can  be  illustrated  as  follows: 
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(2)  Definition  of  the  product  market 

230  Based  on  the  criterion  of  demand-side  substitution,  the  investigations  have  shown  that, 
from  the  private  users’  perspective,  there  is  a  market  for  social  networks  in  terms  of 
characteristics,  application  and  price.  The  relevant  opposite  market  side  are  private 
users  (see  a).  A  market  can  be  defined  although  the  service  is  available  to  private  users 
free  of  charge  (see  b).  In  the  context  of  social  media,  social  networks  meet  a  specific 
demand  private  users  have  (see  c).  Only  StudiVZ,  Jappy  and,  until  it  was  discontinued, 
Google+  can  be  included  in  the  market,  whereas  all  the  other  services  represent 
competition  from  substitutes  (see  d). 

(a)  Relevant  opposite  market  side:  private  users 

231  The  relevant  opposite  market  side  to  determine  the  substitutability  of  social  networks 
with  Facebook.com  is  represented  by  the  private  end  consumers.  They  form  a  separate 
market  side  apart  from  the  other  user  groups  of  the  social  network,  i.e.  advertisers, 
publishers  and  developers. 

232  The  market  sides  of  the  multi-sided  market  are  not  a  uniform  opposite  market  side. 
For  the  user  groups  of  advertisers,  publishers  and  developers,  Facebook  meets 
different  requirements  than  for  private  users. 
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233  Generally  speaking,  the  Bundeskartellamt  considers  it  possible  to  carry  out  a  uniform 
market  definition  which  does  not  differentiate  between  different  user  groups,  especially 
if  the  product,  which  is  an  intermediary  product,  does  not  exist  unless  several  user 
groups  use  it  to  a  sufficient  extent.204  A  uniform  market  definition  that  comprises  several 
or  all  market  sides  has  to  consider  the  criterion  of  demand-side  substitutability.  It  can 
only  be  assumed  to  apply  if  all  the  user  groups  have  essentially  the  same  view  of  the 
service’s  functional  substitutability,  i.e.  if  they  have  mostly  similar  requirements.205 

234  Facebook. corn’s  various  user  groups  are  not  essential  to  creating  a  social  network  as 
a  service.  The  groups’  requirements  are  not  largely  similar  to  those  of  private  users 
either. 

235  In  particular  advertisers  using  Facebook.com  for  targeted  advertising  have  different 
requirements  and  thus  generate  the  market  side  of  an  audience  providing  platform. 
Audience  providing  platforms  generally  cannot  be  defined  as  a  uniform  market.  As  the 
product,  i.e.  the  social  network,  is  not  conditional  on  the  other  side  being  represented 
as  well,  this  side  is  not  required  for  the  product.  By  adding  the  advertisers'  side,  the 
company  rather  monetarises  an  existing  product,  i.e.  its  service,  by  offering  advertising 
space  within  that  service.  The  advertising  side  is  added  on  the  basis  of  a  decision  to 
generate  funding  through  advertising  rather  than  being  a  result  of  the  social  network’s 
intermediary  function.  A  uniform  market  definition  is  not  required  for  taking  into  account 
the  indirect  network  effects,  either.  As  has  been  shown,  the  platform  is  characterised 
by  asymmetrical  indirect  network  effects:  Clearly  positive  indirect  network  effects 
emanate  in  particular  from  the  (free)  user  side  to  the  benefit  of  the  advertising  side,  as 
the  platform’s  benefits  for  advertisers  increase  with  an  increasing  number  of  users  on 
the  other  side.  Conversely,  an  increasing  number  of  adverts  on  the  platform  do  not 
normally  increase  the  benefits  for  the  other  user  group;  the  indirect  network  effects  are 
hence  less  pronounced  or  even  negative.  Additionally,  the  requirements  of  private 
users  on  the  one  hand  and  advertisers  on  the  other  cannot  be  assumed  to  be  identical. 
While  advertisers  use  Facebook.com  for  marketing  purposes,  private  users  intend  to 
use  the  social  network  functionalities  to  fulfil  other  requirements.  It  can  also  be 
assumed  that  the  two  user  groups  have  different  views  on  their  options  for  substitution, 
although  the  advertising  side  is  oriented  towards  their  target  group,  which  can  lead  to 


204  So-called  matching  platforms,  cf.  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and 
Networks",  June  2016,  p.  22  ff.,  available  at 

https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Berichte/Think-Tank-Bericht- 

Langfassunq.pdf?  blob=publicationFile&v=2  (last  accessed  on  10  January  2019). 

205  BKartA-  Parship/Elitepartner,  B6-57/15,  decision  of  22  October  2015,  para.  71  ff.;  BKartA-  Immonet/lmmowelt, 
B6-39/15,  case  summary  of  20  April  2015;  BKartA  -  P7S1/Verivox,  B8-67/15,  case  summary  of  5  August  2015; 
BKartA  -  HRS,  B9-66/10,  decision  of  20  December  2013;  cf.  Bundeskartellamt,  Working  paper  "Market  Power 
of  Platforms  and  Networks",  June  2016,  p.  31  ff. 
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similar  market  definitions  as  the  advertisements  are  mostly  in  line  with  the  target 
group’s  expectations.206 

236  The  same  is  true  for  publishers,  who  also  use  Facebook.com  to  fulfil  other 
requirements  than  private  users.  Publishers  use  Facebook.com  in  a  way  that  is  closely 
linked  to  private  use  in  many  ways.  From  the  private  users’  perspective,  this  constitutes 
part  of  the  functionalities  of  a  social  network.  However,  it  cannot  be  assumed  that  the 
two  user  groups  have  the  same  requirements.  Publishers  use  Facebook  for  other 
purposes  than  private  users,  namely  to  make  their  own  company  or  business  known 
among  Facebook’s  users  through  their  own  “page”.  They  thus  first  and  foremost  pursue 
marketing  objectives  and  constitute  a  user  group  which  has  its  own  characteristics. 
Again,  the  options  for  substitution  are  different  for  each  user  group. 

237  And  finally,  developers  have  completely  different  requirements  than  private  individuals 
when  using  the  APIs.  The  different  APIs  are  special  software  products  which  primarily 
serve  to  grant  technical  access  to  the  social  network  and  its  users,  hence  its  scope,  in 
order  to  improve  or  monetise  a  product.  For  this  reason,  uniform  demand  from  private 
users  and  developers  cannot  be  assumed. 

(b)  A  service  free  of  charge  for  users 

238  The  service  can  be  considered  part  of  a  social  network  market  despite  the  fact  that 
private  users  do  not  pay  for  using  it. 

i.  Market  activity  with  free  user  services  within  the  meaning  of  Section 
18(2a)  GWB 

239  Despite  the  fact  that  private  users  do  not  pay  a  fee  for  using  the  social  network,  this 
service  is  to  be  considered  a  market  activity  as  it  fulfils  the  requirements  of  Section 
18(2a)  GWB  as  far  as  the  advertising  side,  which  is  payable,  is  concerned. 

240  Previous  (national)  case  law  had  not  recognised  free  platform  use  as  a  market  because 
it  considered  monetary  turnover  and  price-setting  essential  competitive  parameters 
without  which  a  market  did  not  exist.  The  Dusseldorf  Higher  Regional  Court  also 
confirmed  this  with  regard  to  an  online  transaction  platform.207  By  including  Section 
18(2a)  in  the  German  Competition  Act,  the  legislator  basically  acknowledged  the 
possibility  for  free  services  to  be  classified  as  a  market  activity;  however,  the  exact 
conditions  for  such  a  classification  were  left  open. 


206  Cf.  Bundeskartellamt,  Case  decision  of  25  April  2015,  ref.  B6-98/13  -  Funke/Springer  (TV  programme 
magazines),  available  at  www.bundeskartellamt.de. 

207  Dusseldorf  Higher  Regional  Court,  decision  of  9  January  2015,  file  ref  Vl-Kart  1/14  (V),  para.  43  -  HRS  (juris). 


67 


241  The  Bundeskartellamt  holds  that,  from  an  economic  and  antitrust  perspective,  a  user 
group  that  uses  the  platform  service  for  free  should  at  least  be  considered  a  market 
under  competition  law  terms  if  it  is  connected  to  a  paying  user  group.  This  is  based  on 
the  consideration  that  there  is  a  close  connection  between  the  activities  of  the  platform 
on  the  advertising  side  and  on  the  "audience"  side.  The  activities  of  the  platform 
therefore  pursue  one  and  the  same  business  purpose  irrespective  of  the  side  towards 
which  they  are  directed.208 

242  This  view  is  also  reflected  in  the  legislative  intent209  which  holds  that  this  applies  in 
particular  in  the  case  of  platforms  with  varying  degrees  of  indirect  network  effects 
between  the  market  sides.  According  to  this  reasoning,  this  could  lead  to  a  situation 
where  one  side  of  a  platform  offered  services  free  of  charge  which  does  not  benefit 
from  the  size  of  the  other  platform  sides  at  all  or  only  to  a  limited  extent.  Advertising- 
financed  services  are  cited  as  the  typical  example  of  a  service  available  to  one  user 
group  free  of  charge  while  the  platform  is  financed  through  advertising. 

243  This  view  is  also  reflected  in  the  European  practice.  In  its  more  recent  case  practice 
(e.g.  the  Facebook/WhatsApp? 10  merger  decision)  the  Commission  examined  several 
online  markets,  including  (ad-funded)  social  networks,  although  users  can  use 
practically  all  of  the  services  offered  without  any  direct  monetary  compensation.211  The 
Commission  had  already  followed  a  similar  approach  in  the  Microsoft/Skype  case.212  In 
the  abuse  proceedings  against  Microsoft  regarding  the  tying  of  a  web  browser  or  media 
player  to  its  PC  operating  system  Windows,  the  Commission  and  the  General  Court 
confirmed  the  existence  of  markets  for  both  components  despite  the  fact  that  they  were 
at  least  to  some  extent  offered  for  free.213  In  the  Commission’s  abuse  decision  of  27 
June  2017  against  Google  for  giving  illegal  advantage  to  its  own  price  comparison 
engine214,  the  Commission  assumed  Google  was  abusing  its  dominant  position  on  the 
markets  for  general  internet  search  engines  in  Europe  even  though  such  search 
engines  are  always  offered  to  users  free  of  charge.215  For  the  sake  of  homogeneous 


208  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  201 6,  p.  36ff. 

209  Legislative  intent  of  the  Federal  Government  on  the  draft  of  the  9th  amendment  to  the  German  Competition  Act, 
Bundestag  printed  paper  18/10207,  p.  48. 

210  European  Commission,  decision  of  3  October  2014,  Ref.  COMP/M. 721 7  -  Facebook/WhatsApp. 

211  See  also  para.  31  of  the  decision. 

212  European  Commission,  decision  of  7  October  2011,  Ref.  COMP/M. 6281  -  Microsoft/Skype,  para.  75 

213  European  Commission,  decision  of  24  March  2004,  Ref.  COMP/C-3/37.792  -  Microsoft,  para.  402;  European 
Commission,  decision  of  16  December  2009,  Ref.  COMP/C-3/39.530  -  Microsoft,  para  17ff;  General  Court, 
decision  of  17  September  2007,  Ref.  T-201/04  -  Microsoft,  para.  927ff,  1088. 

214  Available  at  http://ec.europa.eu/competition/antitrust/cases/dec  docs/39740/39740  14996  3.pdf  (last 
accessed  on  10  January  2019),  para.  157ff. 

215  European  Commission,  decision  of  27  June  2017,  Ref.  AT.39740,  available  under 
http://ec.europa.eu/competition/antitrust/cases/dec  docs/39740/39740  14996  3.pdf,  para.  158-160. 


68 


competition  rules  within  Europe,  a  change  of  the  current  practice  in  Germany  therefore 
seems  to  be  called  for. 

244  As,  pursuant  to  Facebook’s  terms  of  service,  a  contract  is  concluded  between 
Facebook.com  and  the  private  users,  it  can  be  left  open  whether  Facebook. corn’s 
service  can  be  classified  as  a  market  within  the  meaning  of  Section  18(2a)  GWB  solely 
because  its  free  service  is  part  of  a  multi-sided  market,  or  whether  a  contract  or  other 
exchange  relationship  has  to  exist.  In  addition,  private  users  giving  away  their  data  can 
be  considered  part  of  an  exchange  relationship.216 

ii.  Applicability  of  demand-side  substitutability 

245  Private  users  can  be  considered  customers  in  the  context  of  the  concept  of  demand- 
side  substitutability,  even  if  the  services  are  available  free  of  charge.  Contrary  to 
Facebook’s  view217,  the  users’  time  and  attention  which,  according  to  the  company,  all 
internet  services  compete  for,  are  not  the  defining  market  elements  in  this  case. 

246  The  fact  that  the  users  do  not  pay  a  monetary  compensation  for  the  private  use  of 
Facebook  does  not  change  the  fact  that  they  use  the  service  to  satisfy  a  certain 
economic  demand,  which  makes  them  customers  of  Facebook’s  product  in  an 
economic  sense.  In  contrast  to  that,  defining  the  market  as  a  market  for  the  users’  time 
or  attention  turns  the  users  into  the  product.  While  many  online  services  share  this 
economic  point  of  view  and  frequently  make  statements  to  this  effect,  competition  law 
takes  a  different  approach  by  looking  at  the  demand  of  the  opposite  market  side  to 
define  the  relevant  product  market.  There  is  thus  no  difference  to  paid  services  all  of 
which  ultimately  compete  for  their  customers’  incomes  while  budgets  are  limited,  which 
does  not  make  their  market  a  “market  for  income”.  The  user  remains  a  customer,  even 
if  the  service  is  available  for  free.  In  this  respect,  time  or  attention  and  the  data  the 
users  enter  replace  the  fee  and  can  be  seen  as  a  compensation  for  the  service.  This 
applies  in  particular  to  ad-funded  services,  which  offer  their  users’  time,  attention  and 
data  to  advertisers  in  return  for  revenues.  Ultimately,  advertising  markets  are  “markets 
for  time”  which  consider  the  users’  time  and  attention  to  be  a  product.  However,  this 
point  of  view  is  restricted  to  the  side  of  a  platform  which  is  only  available  for  a  fee. 
Section  18(2a)  GWB  has  been  set  up  precisely  to  eliminate  this  restriction. 

247  Facebook’s  claim  is  not  based  on  the  necessary  demand-oriented  view  and  criticises 
the  Bundeskartellamt's  position,  which  is  based  on  competition  law,  for  ignoring  the 


216  Cf.  European  Commission,  decision  of  27  June  2017,  ref.  AT.39740,  para.  158-160. 
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view  of  third-party  companies  that  know  the  market  well.218  Aside  from  the  fact  that, 
contrary  to  Facebook’s  claim,  most  of  the  competitor  survey  does  not  support  this  point 
of  view,  the  concept  of  demand-side  substitutability  is  a  concept  to  be  considered  under 
competition  law  when  defining  a  market,  irrespective  of  the  companies’  expertise.  The 
Bundeskartellamt  also  has  no  doubt  that  Facebook  views  its  customers  as  the  (data) 
centre  on  which  its  commercial  interests  are  focused.  Still,  this  view  does  not  justify 
putting  customers  in  the  position  of  suppliers  of  time  and  attention. 

248  The  demand-side  oriented  market  concept  is  also  perfectly  suitable  for  determining  the 
demand  for  free  market  services.  From  the  customers’  perspective,  the  products  can 
thus  be  differentiated  by  their  properties  and  applications.  Additionally,  when  defining 
the  market,  the  “price  amounting  to  zero”  and  the  general  significance  of  the  willingness 
to  pay  can  be  considered.  Facebook  is  therefore  wrong  in  claiming  that  a  price-oriented 
approach  is  impossible  in  the  case  of  “free”  services.219  The  fact  that  the  SSNIP  test  as 
a  methodological  characteristic  of  the  demand-side  oriented  market  concept,  which  is 
only  rarely  applicable  in  practice  anyway,  does  not  apply  to  free  services  does  not  make 
the  demand-side  oriented  market  concept  inapplicable.  As  a  matter  of  fact,  the  factors 
of  time  and  temporal  intensity  of  use  are  product  characteristics,  especially  when  it 
comes  to  social  media,  and  thus  have  to  be  considered  when  defining  the  market. 

(c)  Specific  demand  for  social  networks 

249  Having  investigated  competitors  and  users,  it  can  be  assumed  that  there  is  a  specific 
demand  for  social  networks,  which  is  fundamentally  different  from  the  demand  for  other 
social  media.  The  key  purpose  of  social  networks  is  finding  and  networking  with  people 
the  users  already  know,  and  to  exchange  on  a  daily  basis  experiences,  opinions  and 
contents  among  specific  contacts  which  the  users  define  based  on  identity.  Providers 
meet  this  demand  by  offering  the  corresponding  core  functionalities  which  grant  users 
a  “rich  social  experience”. 

250  The  competitors  emphasise  this  rich  social  experience  through  communication  and 
exchange  with  other  users  when  explaining  what  social  networks  do  for  users.220  The 
intention  of  social  networks  is  to  provide  users  with  a  comprehensive  personalised 
“virtual  space”.221  The  network  is  to  enable  users  to  develop  “authentic  interpersonal 
relationships”.222  The  users’  own  “virtual  identities”  are  supposed  to  be  at  the  heart  of 


218  [...] 

219  [...] 

220  European  Commission,  decision  of  3  October  2014,  “Facebook/WhatsApp“,  Comp/M.  7121,  para.  54. 
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their  user  experiences  and  can  be  set  up  by  creating  a  personal  profile  and  starting  a 
list  of  friends.  The  purpose  of  a  user’s  online  identity  is  supposed  to  be  a  virtual 
reflection  of  real  life.223  All  activities  of  users  in  a  social  network  are  related  to  their 
personal  networks  of  friends  and  acquaintances,  which  creates  a  “highly  personalised 
experience.”224  Value  is  added  to  any  contents  shared  among  the  personal  contacts 
within  the  social  networks  because  it  is  embedded  in  the  personal  network  of  friends 
and  acquaintances.  Depending  on  their  preferences,  users  can  develop  all  kinds  of 
activities  in  this  virtual  space.  Such  activities  include  entering  and  staying  in  touch  with 
friends  and  finding  people  users  used  to  know,  sharing  contents  (either  generated  by 
the  social  network  or  by  third-party  websites),  information  on  events,  playing  online 
games  or  buying  and  selling  goods,  e.g.  via  Facebook  Marketplace.  Facebook 
describes  the  key  functions  of  its  social  network  as  “connect”,  “communicate”,  “share”, 
and  “discover”.225 

251  The  outcome  of  the  user  survey  confirms  this  description  of  demand.  Contrary  to 
Facebook’s  view226,  this  description  is  in  particular  also  based  on  the  replies  received 
from  its  competitors.  In  its  user  survey  the  Decision  Division  asked  for  reasons  why 
social  media  are  used  (question  7),  how  frequently  the  services  are  used  and  how  much 
time  is  spent  using  the  services  (questions  5  and  5.3).  It  also  enquired  which  reasons 
would  be  needed  to  switch  from  one  service  to  another  (questions  10  and  11). 

252  The  survey  shows  that  most  users  use  social  media  to  stay  in  touch  with  friends  (90%), 
to  write  messages  (90%),  as  a  pastime  (83%),  to  read  contents  provided  by  others 
(77%),  to  share  their  own  contents  (72%),  to  look  for  people  they  know  (65%)  and  to 
organise  events  (52%).  Less  than  half  of  the  users  use  social  media  to  follow 
companies  or  celebrities  (50%),  for  professional  contacts  (41%),  for  news  updates 
(36%),  to  meet  new  people  (24%),  to  promote  their  own  website  (1 5%)  or  to  play  games 
(13%). 227 

253  The  survey  showed  that  users  basically  use  Facebook.com  for  all  the  listed 
applications.  Users  said  Facebook.com  was  either  the  most  frequently  or  second  most 
frequently  used  service  for  looking  for  people  they  know  (52%),  reading  contents 
provided  by  others  (53%),  finding  information  on  events  and  products  (36%),  following 
brands  and  celebrities  (39%)  as  well  as  for  entertainment  and  their  pastime  (44%). 228 
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Compared  to  other  social  media,  a  key  element  of  Facebook.com  usage  is  looking  for 
people  the  users  know.  The  fact  that  Facebook.com  is  used  for  a  wider  range  of 
applications  than  other  services  shows  that  comprehensive  social  exchanges  take 
place  on  Facebook.com.  The  comprehensive  use  of  the  personal  “virtual  space”  is  a 
testament  to  this. 

254  The  survey  also  showed  that  the  frequency  of  use  is  also  an  important  element  when 
it  comes  to  determining  the  demand  for  a  social  network.  The  frequency  of  use  varies 
considerably  from  one  service  to  another:  84%  of  WhatsApp  users  use  WhatsApp  at 
least  once  per  day,  65%  of  the  Facebook  users  access  Facebook.com  every  day,  and 
40%  of  users  of  Instagram  and  Snapchat  use  these  services  at  least  once  per  day.  In 
contrast  to  that,  only  23%  of  the  Google+  users,  19%  of  the  Twitter  users  and  17%  of 
the  YouTube  users  said  they  used  the  service  at  least  once  per  day. 

255  Those  users  who  said  they  used  individual  services  several  times  a  day  were  asked  for 
the  average  time  they  spend  using  these  services  per  day.  The  answers  users  gave 
varied  considerably.  On  the  one  hand,  the  reason  for  this  could  be  that  users  find  it 
difficult  to  estimate  the  average  amount  of  time  they  spend  using  a  network  per  day; 
on  the  other  hand,  their  replies  suggest  that  some  users  have  understood  the  question 
to  refer  to  their  readiness  to  use  the  network.  Some  users,  for  example,  said  they  used 
the  service  every  day  for  1440  minutes.  The  considerable  variation  in  stated  average 
daily  usage  duration  makes  the  median229  more  meaningful  than  the  mean  value. 
Facebook. corn’s  median  value  is  50  minutes.  The  other  services,  in  particular  those 
which  are  used  daily,  have  median  values  of  30  minutes  (Google+,  WhatsApp, 
Threema  and  Snapchat),  or  15  minutes  (Telegram  and  iMessage). 

256  In  Facebook. corn’s  case,  multiple  daily  access  and  the  large  amount  of  time  spent  on 
the  network  combined  with  the  wide  range  of  applications  the  network  provides,  support 
the  social  network’s  function  as  a  comprehensive  personal  “virtual  space”  for  an  in- 
depth  social  user  experience. 

257  The  market  investigations  have  shown  that  this  demand  is  reflected  by  the  typical  basic 
functions  of  a  social  network.  It  must  be  noted  that  there  is  no  standard  range  of  social 
network  functionalities.  Facebook’s  view  that  the  Bundeskartellamt  had  deduced  a 
certain  range  of  functionalities,  in  particular  from  the  replies  to  the  question  referring  to 
applications,  is  therefore  inexplicable.230  A  range  of  features  and  functions,  however, 
can  be  regarded  as  characteristics  of  a  social  network,  as  they  constitute  the  basis  for 


229  The  median  is  the  value  at  the  centre  of  a  list  of  numeric  values  sorted  by  value. 

230  [•  ] 


72 


the  described  comprehensive  personal  “virtual  space”.231  Typically,  these  include  the 
obligation  to  register,  a  detailed  personal  profile,  a  personal  contact  list,  functionalities 
to  find  others  (“friend  finding”),  communication  options  with  other  users  and  the 
customised  presentation  of  contents  in  a  newsfeed.  The  European  Commission's 
market  investigations  in  the  “Microsoft/Linkedln”  merger  case  had  a  similar  outcome.232 
Details  of  the  case: 

258  To  use  a  social  network,  its  users  must  register  by  at  least  entering  a  user  name  and 
e-mail  address  or  mobile  phone  number.233  Based  on  their  registration,  users  can  be 
found  in  the  network  and  contact  other  users  they  know. 

259  Another  typical  characteristic  of  a  social  network  is  the  possibility  to  set  up  a  personal 
user  profile.234  Users  can  enter  information  on  their  places  of  residence,  marital  status, 
vocational  qualification,  occupation  and  hobbies,  interests  and  political  views.  A  user’s 
virtual  identity  is  supposed  to  be  a  reflection  of  his/her  real  life,  and  thus  to  constitute 
an  “online  identity”.  For  this  reason,  the  user’s  true  identity  can  often  be  deduced  from 
his/her  social  network  profile,  which  at  least  gives  enough  details  for  other  users  to 
imagine  what  the  personality  of  the  actual  person  behind  the  online  profile  is  like. 

260  Users  can  develop  a  far-reaching  personal  network  through  social  networks.  A  contact 
list  is  therefore  a  typical  part  of  social  networks.  Users  can  connect  with  the  listed 
members  of  the  network  community,  e.g.  friends,  acquaintances  and  family,  and 
manage  and  expand  their  contact  lists.  Most  networks  allow  their  users  to  control 
through  privacy  settings  who  can  see  what  content  of  their  profiles  and  who  may 
contact  them.  They  can  adjust  the  social  network  to  fit  their  own  personal  network  and 
usage  habits  and  to  only  include  their  specifically  defined  circle  of  friends  and 
acquaintances.235  Social  networks  also  offer  “friend  finding”  functionalities  to  look  for 
new  contacts  in  the  network.  Most  services  offer  extended  search  functions,  filters  or 
active  “friend  finding”  functionalities.  Users  are  suggested  as  contacts  to  other  users 
who  could  know  them  or  be  interested  in  getting  to  know  them.236 


231  [...] 

232  European  Commission,  COMP/M.  8124,  “Microsoft/Linkedln”,  decision  of  6  December  2016,  para.  98  In  this 
investigation  the  market  players  stated  that  the  following  functions  were  vital  for  a  social  network:  “creation  of  a 
user  profile  and  the  possibility  to  send/receive  messages ,  closely  followed  by  several  others  (search  for  other 
people  In  the  network,  send/accept  invitations  to  connect  with  new  contacts,  post/share  content,  post  comments 
on  items  posted  by  others ,  interact  with  other  users  through  private  or  public  groups  and  have  a  newsfeed 
displaying  news  from  the  user’s  connections 

233  [  ] 

234  [...] 

235  On  Facebook,  for  instance,  users  can  define  their  own  privacy  settings,  deciding  whether  their  content  is 
displayed  to  friends  or  “close”  friends  only  or  whether  it  is  publicly  visible  to  all  users.  See  Facebook’s  “privacy 
check”,  www.facebook.de  ,  [...] 

236  [...] 
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261  Typically,  social  networks  have  a  newsfeed  which  filters  the  network  content  based  on 
a  user’s  prior  behaviour,  displaying  and  ranking  potentially  relevant  contents  for  each 
user.237  [. .  .]238  [. .  .]239 

262  Further  typical  functionalities  of  social  networks  include  various  communication 
tools240  for  sending  or  receiving  contents  or  news  to  various  groups  of  contacts.  Users 
can  communicate  through  texts  or  photos.  Video  and  voice  messages  can  also  be 
exchanged  through  Facebook.com.241  A  social  network  can  also  include  chat  or 
messenger  functions  for  bilateral  or  group  contact  in  real  time.  Other  than 
communication  options  through  posts  or  comments  on  Facebook  pages, 
Facebook.com  also  offers  Facebook  Messenger,  which  can  be  used  both  as  a  part  of 
Facebook.com  and,  separately,  as  a  (especially  mobile)  application.  Facebook 
Messenger  can  be  used  for  sending  messages  and  for  making  telephone  and  video 
calls. 

263  All  in  all  the  use  of  social  networks  does  not  depend  on  the  terminal  or  operating 
system  used.  The  user  survey  has  shown  that  most  users  of  online  services  use  both 
desktop  and  mobile  applications  for  these  services,  with  an  increasing  tendency  to  use 
mobile  apps.242  There  are  other  studies  confirming  this  tendency  towards  mobile  social 
media  usage.243  As  most  services  are  compatible  with  all  operating  systems,  the  type 
of  operating  system  a  user  has  (Windows,  MacOS,  Android,  iOS,  Blackberry  or  Linux) 
is  not  relevant  in  this  context.  This  result  matches  with  the  Commission's  decisional 
practice.  It  did  not  differentiate  between  the  terminal  devices  or  operating  systems  used 
in  the  “Facebook/WhatsApp”  and  “Microsoft/Linkedln”  cases  after  having  conducted  its 
own  market  research.244 

(d)  Services  to  be  considered 

264  Besides  Facebook.com,  the  only  other  services  to  be  included  in  the  market  for  social 
networks  are  StudiVZ  and  Jappy,  as  they  offer  similar  functionalities  and  fulfil  the  same 


237  [■■■] 
238  [...] 
239  [...] 

240  [  ] 

241  [■■■] 

242  [  j 


243  See  for  instance  BITKOM  study  (in  German),  “Jung  und  vernetzt  -  Kinder  und  Jugendliche  in  der  digitalen 
Wirtschaft“,  2014,  p.  14,  according  to  which  particularly  users  between  16  and  18  years  mostly  use  the  internet 
through  their  smartphones.  https://www.bitkom.orq/noindex/Publikationen/2014/Studien/Juna-und-vernetzt- 
Kinder-und-Juaendliche-in-der-diaitalen-Gesellschaft/BITKOM-Studie-Juna-und-vernetzt-201 4.pdf  (last 

accessed  on  10  January  2019)  [...] 


244  European  Commission,  COMP/M.  8124,  “Microsoft/Linkedln”,  decision  of  6  December  2016,  para.  96., 
COMP/M.  7217,  “Facebook/WhatsApp”,  decision  of  3  October  2014,  para.  57-59 
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purpose,  albeit  with  limited  scope  for  substitutability.  Google+  used  to  be  part  of  the 
market  where  the  service  was  offered  to  private  users  (see  i).  Professional  networks 
and  career  portals  (Xing,  Linkedln,  Indeed,  Stepstone  -  see  ii)  are  not  part  of  the  market 
for  private  social  networks.  A  separate  market  has  to  be  defined  for  messaging  services 
(SnapChat,  WhatsApp,  Telegram,  Skype,  Threema,  FaceTime,  WeChat,  iMessage, 
Line,  Viber,  Yahoo  Messenger,  see  iii).  YouTube,  Twitter,  Pinterest  (see  iv.)  and  other 
social  media  (see  v.)  are  not  social  networks. 

i.  StudiVZ,  Jappy  and  (formerly)  Google+, 

265  StudiVZ,  Jappy  and,  until  its  discontinuation,  Google+  are  the  only  services  to  be 
included  in  the  market,  with  the  possible  exceptions  of  StayFriends  and  WizeLife.  They 
offer(ed)  typical  social  network  functionalities.  Plowever,  due  to  the  direct  network 
effects  emanating  from  Facebook.com,  their  substitutability  is  limited. 

•  Classification  as  social  networks 

266  The  Google+  service  in  particular  could  be  classified  as  a  social  network.  The  version 
for  private  users  served  to  find  and  connect  with  people  the  users  knew  and  to 
exchange  opinions,  experiences  and  contents  on  a  daily  basis  among  groups  defined 
and  identified  by  each  user.  The  company  considered  itself  a  social  network  and 
entered  the  market  in  201 0,  opening  its  network  to  all  users  in  201 1 ,  to  directly  compete 
with  Facebook.com.  The  network  addressed  private  users  wishing  to  participate  in  an 
extensive  social  exchange  via  a  personalised  virtual  space.  For  this  purpose,  Google+ 
offered  the  corresponding  core  functionalities  (see  above,  para.  258),  which  were  to 
grant  users  an  intensive  social  user  experience.  The  Google+  business  version,  which 
is  available  for  a  fee  as  part  of  the  “G-Suite”,  however,  is  not  part  of  the  market,  as  it 
focuses  on  professional  use  (see  ii  below). 

267  The  private  user  version  of  Google+  was  not  directly  monetised  through  advertising  or 
other  sales.  All  users,  including  companies,  could  use  the  network  for  free.  There  was 
no  direct  advertising  on  Google+.  Although  the  service  was  not  directly  linked  to  a 
market  side  subject  to  payment,  it  was  to  be  classified  as  a  market  service  pursuant  to 
Section  18(2a)  GWB.  The  service  was  linked  to  advertising-financed  Google  services, 
particularly  the  Google  search  engine.  User  data  generated  from  the  use  of  various 
Google  services  was  accumulated  and  used  for  advertising  purposes.245  Combined 
with  the  remaining  Google  services,  particularly  the  search  engine,  Google-i-  served  a 


245  see  Google’s  privacy  policy,  section  “Why  Google  collects  data”:  “We  may  combine  the  information  we  collect 
among  our  services  and  across  your  devices  for  other  Google  services.”  This  feature  makes  it  easier  to  share 
things  with  people  you  know.  Depending  on  your  account  settings,  your  activity  on  other  sites  and  apps  may 
be  associated  with  your  personal  information  in  order  to  improve  Google’s  services  and  the  ads  delivered  by 
Google.”,  to  be  found  on  https://policies.aooale.com/privacv  (last  accessed  on  1 0  January  2019). 
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common  purpose  to  generate  profit246  and  thus  constituted  a  market  service  pursuant 
to  Section  18(2a)  GWB. 

268  The  ad-funded  VZ  services  (StudiVZ  and  MeinVZ)  (see  above,  para.  199)  and  Jappy 
(see  above  para.  187)  are  also  classified  as  social  networks  and  offer  the  typical 
functionalities.  StayFriends  (see  above,  para.  197)  basically  also  serves  to  connect 
with  people  the  users  know,  but  the  target  group  is  considerably  smaller. 

269  The  platform  serves  to  find  friends  from  school  and  stay  in  touch  with  them.  Users  have 
to  register  naming  the  schools  they  went  to  and  state  their  names  at  the  time  they 
studied  there.  However,  the  user  survey  has  shown  that  StayFriends  is  used  less 
intensively.  In  contrast  to  a  large  number  of  other  services,  66%  of  StayFriends  users 
log  on  to  the  service  less  than  once  per  month,  staying  logged  on  for  approx.  10 
minutes,  which  is  a  comparatively  short  period  of  use.247  The  network  is  thus  unlikely 
to  create  a  virtual  social  space,  but  rather  a  service  offering  occasional  contact  with 
former  classmates  and  enabling  personal  contacts  via  the  organisation  of  class 
reunions.  In  addition  to  that,  only  StayFriend’s  very  limited  basic  version  is  available 
free  of  charge.  Its  most  important  functions,  including  communication  options,  are  only 
available  to  gold  members,  who  pay  an  annual  fee  of  €30. 248 

270  The  user  survey  has  shown  that  this  “Freemium”  business  model  does  not  generally 
exclude  the  network  from  the  social  network  market.  Users  of  private  social  networks 
tend  to  be  unwilling  to  pay  for  the  services.  Most  social  networks  are  thus  free  of  charge 
for  their  users  and  mostly  funded  through  advertising.249  According  to  the  user  survey, 
84%  of  the  respondents250  currently  do  not  use  a  service  that  has  to  be  paid  for.251 
Some  users  said  they  were  willing  to  pay  for  additional  services  like  premium  functions 
or  an  advertising-free  service.252  It  could  therefore  be  considered  to  include 
StayFriends  in  the  list  of  possible  substitutes  as  it  offers  an  advertising-free  service  for 
a  small  annual  fee.253  However,  the  percentage  of  StayFriends  users  who  are  gold 
members,  which  is  the  prerequisite  for  using  all  functions,  is  comparatively  low.  For  this 
reason,  the  service  is  not  a  substitute  for  advertising-financed  social  networks  like 
Facebook.com,  Google-i-  or  Jappy.  This  question,  however,  can  ultimately  be  left  open. 


246  For  more  information,  please  refer  to  the  Bundeskartellamt’s  Working  paper  "Market  Power  of  Platforms  and 
Networks”  of  June  2016,  p.  36;  Government  reasoning  to  9th  amendment  to  the  German  Competition  Act, 
Bundestag  printed  paper  18/10207,  p.  48. 

247  [■■■] 
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250  German  internet  users  aged  1 4  or  older  who  use  selected  social  media. 
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252 
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The  same  applies  to  the  “Odnoklassniki”  service,  which  offers  all  the  functions  of  a 
social  network,  albeit  not  in  German. 

271  The  Wize.Life  service  (see  para.  207  above)  also  has  typical  social  network 
functionalities.  However,  the  service  also  addresses  the  small  “best  ager”  target  group 
aged  40  or  older  and  emphasises  the  option  to  meet  like-minded  people  on  the 
platform,  both  online  and  in  person.254  Due  to  its  focus  on  older  users,  Wize.Life  does 
not  consider  itself  a  competitor  of  Facebook.com,  but  rather  of  www.feierabend.de  or 
www.platinnetz.de,  which  also  address  senior  citizens.255  Its  users  also  do  not  log  on 
frequently  enough  for  the  network  to  be  a  substitute  for  the  social  user  experience 
offered  by  other  social  networks.  Ultimately,  this  question  can  be  left  open. 

•  Direct  network  effects  limit  substitutability 

272  Despite  the  fact  that  the  products  Facebook.com  and  (until  recently)  Google+,  StudiVZ, 
Jappy  and  other  services  are  basically  similar,  their  substitutability  is  limited  due  to  the 
direct  network  effects  existing  with  Facebook.com.  As  was  outlined  above  (see  para. 
217),  there  are  positive  direct  network  effects  among  private  users  of  Facebook.com, 
as  users  of  this  group  directly  benefit  from  more  members  of  their  own  user  group  being 
on  Facebook.com. 

273  The  connection  between  the  users  that  leads  to  the  network  effects  can  be  either  direct 
or  indirect.  Social  networks  are  mainly  characterised  by  direct  network  effects 
developing  between  their  members.  They  primarily  serve  to  connect  friends  and 
acquaintances  and  to  enable  communication  between  them.  The  more  private  users 
are  active  on  Facebook.com,  the  higher  the  benefits  for  everyone  in  this  user  group  as 
the  options  for  users  to  interact  and  find  friends  and  acquaintances  increase  with  an 
increasing  number  of  users  in  the  social  network.  The  network  effects  are  “identity- 
based”  because  the  users’  identity  rather  than  just  the  number  of  users  is  relevant  in 
this  context.  Individual  consumers  practically  only  benefit  from  the  virtual  social 
community  rather  than  the  functionalities  of  the  social  network.  The  network’s  value  for 
individual  consumers  increases  with  an  increasing  number  of  people  from  their  social 
context  who  join  the  network.256 

274  A  social  network’s  size  is  thus  a  key  criterion  for  the  substitutability  of  services  from  the 
customers’  perspective.  When  it  comes  to  identity-based  network  effects,  it  is 
particularly  important  that  users  find  exactly  the  people  they  are  looking  for  in  the 


254  The  same  applies  to  the  services  provided  by  “Platinnetz”  and  “Feierabend”  (both  services  belong  to  Feierabend 
Online  Dienste  fur  Senioren  AG  based  in  Frankfurt  am  Main  and  have  a  maximum  of  [...]  members),  which,  like 
Wize.Life,  are  often  perceived  as  dating  platforms  as  they  offer  people  to  meet  each  other. 

255 

256  Dewenter/Rosch,  Einfuhrung  in  die  neue  Okonomie  der  Medienmarkte  (available  in  German  only),  2015,  p.  27. 
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network.  The  user  survey  has  also  shown  that  the  decisive  criterion  for  users  is  whether 
their  friends  use  the  network  too.  Approx.  85%  of  the  respondents  said  they  found  it  at 
least  important  that  their  friends  also  use  the  network.257  75%  of  the  Facebook  users 
would  thus  make  more  use  of  a  service  other  than  Facebook.com  if  their  friends  were 
using  that  service.258  Some  companies  emphasise  that  the  likelihood  of  finding  friends 
and  acquaintances  on  a  network  increases  proportionally  to  the  network’s  absolute 
size.259  According  to  them,  all  companies  aimed  at  expanding  their  networks  to  an 
extent  that  allows  users  to  find  and  contact  the  “right  people”  there.260  Another  factor  of 
interest,  according  to  the  companies,  was  the  members’  activity  on  the  network,  i.e.  the 
intensity  with  which  they  use  the  network  and  the  quality  of  the  contents  provided.261 
The  quality  of  the  contents  provided  depended  on  the  network’s  data  width  and  depth 
in  terms  of  personal  data  and  data  on  user  interests  and  behaviour.262  The  network’s 
size  and  intensity  of  use  are  two  mutually  reinforcing  factors.263 

275  With  users  selecting  a  network  based  on  information  from  public  sources,  there  is 
reason  to  doubt  that  they  would  replace  Facebook  with  smaller  networks  like  StudiVZ 
or  Jappy  in  view  of  Facebook. corn’s  absolute  user  numbers  in  Germany,  which  have 
been  publicly  communicated264.  Facebook.com  has  23  million  daily  active  users , 
whereas  less  than  a  million  users  are  registered  with  StudiVZ  (2016)  and  Jappy.  The 
number  of  daily  active  users  for  the  latter  is  even  lower,  i.e.  these  networks  are  merely 
a  supplement  to  other  social  networks.265 

276  The  substitutability  of  Google+  under  this  aspect  was  limited,  too.  While  the  user 
numbers  of  Google+  were  larger  than  those  of  its  German  competitors,  they  still  did  not 
come  near  the  user  numbers  achieved  by  Facebook.com.266  Fiowever,  Google+  had 
an  absolute  size  for  a  while  that  made  it  likely  for  friends  and  acquaintances  to  find 
each  other  there.  Users  ultimately  select  the  network  on  which  they  actually  find  their 
friends  for  their  daily  activities,  as  was  shown  by  the  user  survey.  Connections  to  friends 
on  Facebook.com  cause  a  strong  lock-in  effect,  which  makes  it  difficult  to  switch 
networks,  as  friends  (and  friends  of  friends,  etc.)  would  have  to  be  convinced  to  switch 
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264  https://allfacebook.de/zahlen  fakten/offiziell-facebook-nutzerzahlen-deutschland,  [...] 

265  Considering  their  small  user  communities,  the  services  “Kwick”  and  “Spin”,  which  could  also  be  considered 
social  networks,  although  the  latter  is  primarily  used  for  its  chat  functionalities,  will  hardly  replace  Facebook. 

266 
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networks,  too.  As  a  consequence,  even  a  “market  for  Facebook”  (single-platform 
market)  can  be  considered.  However,  the  outcome  of  this  consideration  can  be  left 
open  as  Google-i-  has  left  the  market  and  the  competitive  assessment  will  not  change, 
even  if  other  services  are  considered  as  well. 

ii.  Professional  networks  like  Linkedln,  Xing,  Indeed  are  no  substitutes 

277  Professional  networks  like  Linkedln  and  Xing,  or  job  search  portals  like  Indeed267  or 
Stepstone  are  not  part  of  the  private  social  network  market.268  While,  like  private  social 
networks,  they  serve  for  developing  personal  networks,  these  networks  focus  on 
professional  contacts,  which  is  why,  in  terms  of  their  purpose  of  use  and  their 
functionalities,  they  are  not  interchangeable  with  private  social  networks.  Also,  their 
users  are  more  willing  to  pay  for  the  service  provided,  as  professional  networks  are 
often  designed  as  “freemium”  services  where  essential  functionalities  are  subject  to 
relatively  high  fees. 

278  Professional  networks  are  mostly  used  for  networking  purposes  in  the  professional 
context.269  While  private  networking  mostly  serves  to  keep  in  touch  with  personal 
contacts,  professional  networks  are  mainly  used  for  fostering  the  users’  careers.  The 
European  Commission  has  reached  the  same  conclusion  in  its  market  investigations 
in  the  context  of  the  “Microsoft/Linkedln”  merger  proceeding.  The  market  players 
questioned  said  they  used  professional  social  networks  for  other  applications  than 
private  social  networks.  The  focus  of  their  user  profiles  was  on  professional  networking, 
and  in  some  cases  it  was  mandatory  for  users  to  include  their  key  career  steps.  The 
Commission’s  decision  in  particular  refers  to  a  Linkedln  study  (“The  Mindset  Divide”) 
investigating  the  different  motivations  for  using  a  private  or  professional  network.  While 
users  wanted  to  “socialize,  stay  in  touch,  be  entertained,  kill  time,  share  content’  with 
private  social  networks,  their  aim  was  to  “maintain  professional  identity,  make  useful 
contacts,  search  for  opportunities,  stay  in  touch,  keep  up  to  date  for  career ”  with 
professional  networks.270 

279  The  market  participants  have  confirmed  this  point  of  view  in  the  current  proceedings. 
Xing  said  private  and  professional  networks  were  “separating”.  Whereas  Facebook  had 
clearly  positioned  itself  as  a  network  for  private  users  (contacts  =  friends,  holiday 


267  https://www.indeed.com/  (last  accessed  on  10  January  2019),  [...] 

268  Cf.  European  Commission,  COMP/M.  8124,  “Microsoft/Linkedln",  decision  of  6  December  201 6,  para.  1 1 5ff . 

269 

270  European  Commission,  COMP/M.  8124,  “Microsoft/Linkedln’’,  decision  of  6  December  2016,  para.  109  with 
reference  to  https://business.linkedin.com/content/dam/business/marketino- 

solutions/global/en  US/site/pdf/wp/linkedin-marketing-solutions-mindset-divide.pdf  (last  accessed  on  1 0 
January  2018),  [...] 
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pictures,  primarily  private  messages  and  groups),  Xing  had  always  focused  on  its 
function  as  a  professional  network,  with  its  target  group  being  professionals.271  The 
user  survey  confirms  this  finding  as  it  has  shown  that  Facebook.com  is  used  tor 
professional  purposes  to  a  limited  extent  only.  Only  6%  of  Facebook’s  users  said  they 
used  Facebook.com  (also)  for  professional  purposes.  Facebook. corn’s  attempt  to 
attract  professional  users  by  offering  a  job  seeker  function272  does  not  mean  that  all 
professional  networks  have  to  be  included  in  its  market. 

280  In  terms  of  their  functionalities,  professional  networks  have  been  designed  for 
professional  networking.  Besides  general  functions  which  are  also  offered  by  private 
social  networks,  they  offer  targeted  functions  for  professional  purposes  like  a  detailed 
job  search  function,  a  job  portal  and  recommendations  for  new  professional  contacts.273 
Users  of  professional  networks  also  post  different  contents  and  connect  with  different 
people.  They  are  more  cautious  about  posting  “private”  content  like  family  pictures, 
holiday  posts,  political  views,  etc.  and  instead  select  content  of  interest  for  (potential) 
employers,  head  hunters  and  colleagues.274 

281  In  addition,  the  user  fees  are  comparatively  high,  especially  on  Xing  and  Linkedln, 
which  also  decreases  the  likelihood  of  substitution.  While  private  networks  offer  their 
services  for  free,  or,  like  StayFriends,  for  a  small  fee,  Xing’s  and  Linkedln’s  business 
model  offers  key  functions  only  for  paying  members.  Targeted  search  and  connection 
with  other  users  for  professional  purposes  is  only  available  to  these  members.275 

282  Xing  for  instance  offers  its  premium  membership  for  EUR  7.95  per  month  (or  EUR  9.95 
for  three  months)  and  an  additional  “ProJobs”  membership  for  EUR  24.95  to  EUR  38.95 
per  month,  depending  on  the  duration.  Xing’s  basic  membership  offers  only  limited 
functionalities  and  no  communication  options,  i.e.  the  key  network  functions  are  only 
available  for  a  fee.276  Linkedln  also  offers  various  premium  packages  for  a  monthly  fee. 
Besides  a  simple  premium  membership,  the  price  of  which  is  similar  to  Xing,  a  “job 
seeker”  membership  is  available  for  EUR  26.17  per  month,  a  “business  plus” 
membership  for  better  professional  networking  for  41.64  per  month,  and  a  corporate 
membership  for  finding  qualified  staff  (“recruiter  lite”)  for  EUR  89.19  per  month.  The 
free  basic  membership  offers  some  communication  options. 


271  [...] 

272  [...] 

273  Outcome  of  the  European  Commission's  market  investigations,  COMP/M.  8124,  “Microsoft/Linkedln",  decision 
of  6  December  201 6,  para.  1 01 . 

274  European  Commission,  COMP/M.  8124,  “Microsoft/Linkedln”,  decision  of  6  December  2016,  para.  104-106. 

275  [...]  www.likedin.com  (last  accessed  on  1 0  January  2019),  under  “Premium”,  [...] 
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283  The  Stepstone  job  portal  also  offers  the  possibility  to  post  job  adverts  or  search  them 
for  a  fee.  Besides,  based  on  their  functions  such  job  portals  are  not  to  be  considered 
as  a  social  network,  but  rather  as  a  brokering  platform  for  employers  and  job  seekers 
which  is  paid  for  by  one  side  of  the  market.  The  job  portal  Indeed  also  requires 
employers  to  pay  for  job  adverts. 

284  Where  professional  networks  and  Facebook.com  are  used  in  parallel,  this  does  not 
indicate  substitutability  and  the  existence  of  a  uniform  market.  In  particular,  this  does 
not  represent  a  parallel  use  of  several  services  which  limits  market  power  pursuant  to 
Section  18(3a)  no.  2  GWB.  The  underlying  assumption  of  Section  18(3a)  GWB  was 
developed  by  Evans/Schmalensee277.  It  holds  that  multi-homing  has  a  limiting  effect  on 
concentration  on  platform  and  network  markets.  Flowever,  this  can  only  apply  if  users 
use  several  platforms  and  networks  in  parallel  to  satisfy  the  same  requirements,  i.e. 
services  of  the  same  markets.278  Multi-homing  itself  is  not  an  indication  of  uniform 
requirements.  Parallel  use  of  various  differentiated  platforms  can,  by  contrast,  be  an 
expression  of  the  fact  that  the  platforms  fulfil  different  requirements  from  the  user’s 
perspective,  so  that  the  different  offers  are  imperfect  substitutes  to  one  another.279 

285  In  this  case,  market  investigations  have  shown  that  professional  and  private  networks 
are  used  for  different  applications  and  are  therefore  no  functional  substitutes  for  one 
another. 

iii.  Messaging  services  excluded 

286  According  to  the  investigations,  the  services  WhatsApp,  Google  Hangouts,  Snapchat, 
Telegram,  Threema,  iMessage,  Skype,  FaceTime,  Line,  WeChat  and  Viber  and  the 
Facebook  Messenger  app,  which  is  used  separately,  cannot  be  attributed  to  the  social 
network  market,  as  they  serve  to  fulfil  complementary  requirements  from  the  users’ 
perspective.  However,  this  does  not  rule  out  the  possibility  that  substitute  competition 
emanates  from  these  services  on  Facebook.com,  including  the  corporate  service 
WhatsApp. 

287  These  services  are  classified  as  messaging  services,  which  are  not  substitutable  for 
social  networks  based  on  their  applications  and  characteristics.  The  investigations 
have  shown  that  these  services  are  mostly  used  in  addition  to  social  networks  to 
complement  their  range  of  services.  While  messaging  services,  like  social  networks, 
serve  to  communicate  with  friends  and  acquaintances,  messaging  services  do  not 


277  See  outline  of  the  Status  of  discussion  at  the  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and 
Networks",  June  2016,  p.  57ff. 

278  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016  ,  p.  62 

279  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016  ,  p.  61 
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allow  the  creation  of  a  virtual  social  space  in  which  users  have  an  intensive  social 
experience  by  being  able  to  exchange  opinions,  experiences  and  messages.  Their 
functionalities  and  use  also  differ  accordingly. 

288  Services  like  WhatsApp,  Snapchat,  Telegram,  Google  Hangouts,  Threema,  Skype,  etc. 
are  often  summarised  as  “Messaging”  or  “Instant  Messaging”  services.  In  its 
decision  on  Facebook/WhatsApp,  the  European  Commission  refers  to  these  and  other 
services  by  using  the  general  term  “consumer  communication  services”280,  which  to  a 
certain  extent  associates  them  with  telecommunications  services  like  SMS  (Short 
Message  Services)  or  e-mail. 

289  “Instant  Messaging”  refers  to  real-time  text  message  chats  between  two  or  more 
participants  which  comprise  photo,  video  or  audio  files.  The  messaging  services  also 
offer  voice  and  video  messaging  options  and  each  have  a  different  focus  regarding  to 
the  functionalities  they  offer.  Skype  for  example  is  particularly  known  for  its  video  chat 
(“Skype”)  function,  but  it  also  offers  all  other  chat  functionalities.  From  a  technological 
point  of  view,  these  services  are  based  on  the  “push  messaging  procedure”,  which 
directly  sends  (“pushes”)  the  messages  to  the  recipient’s  device.  The  services  use  a 
network  protocol  which  facilitates  an  exchange  of  data  between  computers.  Like 
WhatsApp  and  Skype,  many  services  use  a  proprietary  protocol.  Users  connect  with 
each  other  through  a  computer  program  or  an  app  (client)  via  a  network,  which  is 
normally  the  internet. 

290  Messaging  services  are  primarily  used  for  rapid  communication.  They  serve  for  point- 
to-point  bilateral  or  group  communication.  Groups  are  set  up  and  managed  by  an 
administrator.  The  content  of  such  communications  quickly  loses  its  relevance  as  the 
communication  takes  place  in  real  time  and  is  thus  not  normally  saved.  For  this  reason, 
the  services  put  their  emphasis  on  functionalities  facilitating  communication  between 
two  people  or  small  groups.281  When  registering  with  the  service,  users  grant  the 
application  access  to  the  list  of  mobile  phone  numbers  saved  on  their  smartphones, 
which  it  uses  to  set  up  a  list  of  contacts  that  normally  includes  the  users’  principal 
contacts.  Users  generally  cannot  add  new  contacts  unless  they  know  their  mobile 
phone  numbers.  There  is  no  option  to  set  up  a  detailed  user  profile  including  personal 
data  like  date  of  birth,  marital  status,  occupation  and  hobbies,  so  there  is  no  “online 
identity”.282  Users  also  cannot  comment  or  rate  the  contents  posted  by  others  as  part 
of  a  bigger  community  or  post  contents  themselves.283  There  is  no  newsfeed,  and  users 


280  European  Commission,  “Facebook/WhatsApp",  decision  of  3  October  2014,  COMP/M.  7217,  para.  13  ff. 
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cannot  see  other  people’s  networks  by  checking  their  lists  of  friends,  as  the  list  of 
contacts  can  normally  only  be  viewed  by  the  user  it  belongs  to. 

291  As  a  result,  messaging  services  lack  the  comprehensive  user  experience  as  facilitated 
by  social  networks  with  regard  to  their  application  and  relating  characteristics.  Skype 
and  Yahoo  Messenger  do  not  consider  themselves  social  networks.284  In  its  notification 
for  the  Facebook/WhatsApp  procedure  with  the  European  Commission,  Facebook 
pointed  to  this  difference  itself.285  Facebook  upholds  the  view  in  the  present  proceeding 
that  users  consider  WhatsApp  the  key  service  for  quick,  personal  and  direct 
communication  with  friends  and  family  (“  WhatsApp  in  many  way  was  considered  the 
de  facto  way  to  communicate “),  whereas  Facebook.com  to  them  is  a  service  for 
obtaining  information  about  friends,  companies  and  other  contents.286  The  user  survey 
conducted  in  the  context  of  this  procedure  confirms  this  result.  It  showed  that  there  is 
a  strong  focus  on  messaging  (76%)  and  contacts  to  friends  (69%),  in  particular  when  it 
comes  to  WhatsApp.287  [...]  Snapchat  studies  also  see  only  partial  overlaps.288 

292  As  is  the  case  with  professional  networks,  a  parallel  use  of  social  networks  and 
messaging  services  does  not  rule  out  the  existence  of  a  uniform  market.  For  the 
purposes  of  the  market  definition,  nothing  can  be  deduced  from  a  parallel  use  as  such. 
Social  networks  and  messaging  services  complement  each  other  with  their  different 
applications,  even  though  they  both  aim  at  communication  with  friends.  The  fact  that 
Facebook.com  offers  Facebook  Messenger,  and  Google+  offered  Google  Flangouts  in 
addition  to  the  communication  options  of  their  social  networks  also  suggests  that  the 
services  are  used  as  complements  to  one  another. 

293  By  defining  separate  applications  for  messaging  services  and  social  networks,  one 
does  not  rule  out  the  possibility  of  substitute  competition  between  the  services  when  it 
comes  to  some  of  their  functions.  Flowever,  direct  network  effects  act  as  a  limiting  factor 
of  competition,  as  is  outlined  above  for  social  networks.  Instead  of  suggesting  that 
messaging  services  are  similar  products  to  social  networks,  the  fact  that  messaging 
services  also  develop  direct  network  effects  further  limits  the  range  of  potential 
(substitution)  competitors.  Messaging  services  are  also  marked  by  identity-based  direct 
network  effects,  as  their  purpose  is  direct  communication  with  specified  friends  and 
acquaintances  who  have  to  use  the  same  messenger  service  as  there  is  no 
compatibility  or  interconnectivity  of  the  services.  For  this  reason,  a  service’s 
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attractiveness  is  higher  if  it  has  a  large  number  of  users.  The  user  survey  for  example 
shows  that  this  applies  to  the  services  named  above  too,  of  which  WhatsApp  has  the 
largest  number  of  users. 

294  Parallel  use  of  the  services  cannot  reduce  the  direct  network  effects  existing  for  each 
of  the  services  unless  exactly  the  same  users  stay  in  touch  with  the  same  circles  of 
friends  who  have  the  same  contacts  on  the  services.  Substitute  competition  can  be 
assumed  to  increase  with  increasing  overlaps  between  the  circles  of  users.  In  this 
regard,  substitute  competition  could  merely  be  assumed  to  exist  between  Facebook 
and  its  WhatsApp  service  [,..]289  However,  the  figures  on  parallel  use  do  not  prove  that 
the  lists  of  friends  and  contacts  are  identical  in  both  services. 

iv.  Snapchat  excluded 

295  Contrary  to  Facebook’s  view290,  the  Snapchat  service  in  particular  cannot  be 
considered  a  direct  competitor.  The  service  cannot  be  considered  a  social  network 
despite  the  fact  that  it  has  further  developed  its  functionalities.  This  service  in  particular 
cannot  be  included  under  the  aspect  of  its  supply-side  substitution,  either. 

296  The  Decision  Division  holds  that  Facebook  is  incorrect  in  claiming  that  Snapchat  is  to 
be  considered  a  social  network.291  [. .  ,]292  While  Snapchat  differs  from  other  messaging 
services  in  certain  aspects,  it  does  not  compare  to  a  social  network  as  a  comprehensive 
personal  virtual  space.293 

297  Snapchat’s  key  function  is  its  smartphone  camera  which  opens  automatically  once  the 
user  starts  the  app.  The  user  is  thus  motivated  to  become  active  immediately  by 
creating  and  sharing  with  his  friends  and  family  so-called  “snaps”,  which  are  mostly 
photos  or  videos  creatively  enhanced  through  lenses  or  filters.  Snaps  are  automatically 
deleted  a  short  while  after  being  viewed  and  are  thus  ephemeral.  Besides  ephemeral 
“snaps”,  users  can  create  “stories”  which  consist  of  a  sequence  of  snaps  (photos, 
videos).  A  user’s  own  contacts  can  see  these  stories  by  default.  They  will  be  available 
for  24  hours  before  being  deleted  automatically.  However,  users  can  save  them  as 
“memories”  before  they  are  deleted.  Commercial  users  can  use  Snapchat  as  a  platform 
for  their  own  “channels”  to  spread  their  editorial  content  via  the  “discover”  function. 
Users  can  view  and  follow  these  channels.  Snapchat  also  has  a  function  permitting 
users  to  find  friends  whose  mobile  phone  number  is  unknown  to  them  via  a  Snapchat 
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code  (see  above,  para.196).  Real  names  are  not  required  on  Snapchat.  Users  can 
enter  a  user  name  and  a  “bitmoji”  profile  picture.  Bitmoji  is  a  functionality  that  has  been 
included  in  Snapchat  since  201 6294.  It  allows  users  to  create  personalised  “avatars” 
(non-identifiable  picture  of  a  person).  Snapchat  does  not  provide  its  users  with  the 
possibility  to  enter  a  differentiated  profile  containing  information  about  their  relationship 
status,  occupation,  place  of  residence  or  interests.295 

298  It  cannot  be  assumed  that  Snapchat  could  substitute  the  social  network  Facebook.com, 
even  though  it  has  functionalities  which  come  closer  to  those  of  social  networks. 
Flowever,  the  described  functions  do  not  provide  for  a  virtual  space  allowing  a 
comprehensive  social  user  experience  using  an  online  identity.  The  country  manager 
of  Snapchat  Germany,  Marianne  Bullwinkel,  thus  rightly  considers  Snapchat  “a  camera 
app  facilitating  a  particularly  creative  way  of  communicating  with  friends  and  family” 
rather  than  as  “social  media”.296  Snapchat’s  competitors  are  Facebook’s  services 
WhatsApp  and  particularly  Instagram  rather  than  Facebook.com.  [...]297  Instagram  is 
particularly  successful  [...]  and  attacks  Snapchat’s  position.298  There  is,  however,  no 
similarly  successful  competition  to  Facebook. corn’s  social  network.  While  Facebook 
states  that  the  “Stories”  function  was  launched  for  Facebook.com  in  2017,  Snapchat’s 
reaction  refers  to  Instagram  [,..].299  In  addition,  German  users  have  been  reluctant  to 
use  these  functionalities  so  far.  The  actual  focus  of  Snapchat  users  continues  to  be  on 
sharing  pictures  with  integrated  filters.300 

299  Snapchat  cannot  be  included  in  the  social  network  market  with  a  view  to  its  supply-side 
substitution  either  [,..]301. 

300  Pursuant  to  the  Federal  Court  of  Justice’s  case-law,  the  definition  of  the  relevant  market 
generally  also  include  products  which  are  no  functional  substitutes  for  those  on  the 
market  in  question,  but  which  form  the  basis  for  manufacturers  to  offer  a  competitor 
product  if  the  competitive  conditions  in  the  market  allow  for  it.  Supply-side  substitution, 


294  Bitmoji  is  a  separate  mobile  app  by  Bitstrip  Inc.,  a  subsidiary  of  Snapchat,  available  since  2016. 

295  [■■■] 

296  http://www.horizont.net/tech/nachrichten/Marianne-Bullwinkel-So-snappen-die-Deutschen-161 163  (in  German, 
last  accessed  on  10  January  2019). 

297  Comparison  of  “Snapchat  Stories"  with  “Instagram  Stories'1  available  (in  German)  at 

http://www.futurebiz.de/artikel/snapchat-instaaram-stories/  (last  accessed  on  10  January  2019),  [...] 

298  Snap,  B6-22/16,  competitor  survey,  p.  3149  of  the  file,  cf. 
https://www.basicthinkinq.de/bloq/2017/06/21/whatsapp-snapchat-stories/  (in  German,  last  accessed  on  10 
January  2019). 

299  [  ] 

300  Study  by  Dusseldorf  University  of  Applied  Sciences  (in  German),  Gerhards,  Claudia  et  al.  (2017),  “Wie  snappt 

Deutschland?  Nutzung  von  Inhalten  und  Wahmehmung  von  Werbung  auf  Snapchat.”  User  survey  study  in 
cooperation  with  whylder  agency,  press  release  of  16  January  2017,  https://wiwi.hs- 

duesseldorf.de/aktuelles/meldunqen/201 701 1 6?showarrows=1  &sid=2oe3cu3dqbpft50bywkhsllw  (last 
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however,  can  only  be  assumed  to  exist  if  the  providers  of  similar  products  are  willing 
and  able  to  modify  their  offer  at  short  notice  and  at  reasonable  economic  cost.302  Unless 
these  preconditions  are  met,  it  cannot  be  assumed  that  the  competitive  pressure 
currently  existing  is  sufficient  to  influence  the  conduct  of  companies  active  on  the 
market  in  a  way  that  would  justify  treating  providers  of  similar  products  like  current 
competitors.303  Unlike  potential  competition,  which  is  assessed  on  the  basis  of  the 
likelihood  and  possibility  of  entering  the  market  in  the  medium  term304,  the  relevant 
criteria  for  defining  the  market  are  that  other  companies  can  switch  their  supply  at  short 
notice  and  low  cost.  Treating  companies  which  are  active  on  similar  markets  as  current 
competitors  is  therefore  only  justified  if  they  can  switch  their  supply  immediately  at  no 
significant  additional  cost.  Such  companies  cannot  be  considered  competitors  if  their 
change  of  supply  would  entail  considerable  adjustments  of  existing  tangible  and 
intangible  assets,  additional  investments,  strategic  decisions  or  delays.  This  view 
corresponds  to  the  European  Commission's  guidelines  for  market  definition.305 

301  It  has  to  be  considered,  in  addition,  that  the  market  has  to  be  defined  for  abuse  control 
purposes.  Unlike  merger  control,  abuse  control  assesses  current,  immediate  or  past 
market  behaviour  towards  individual  market  players  rather  than  the  future  market 
structure.  Pursuant  to  the  Federal  Court  of  Justice’s  case-law,  each  individual  case 
must  be  carefully  examined  when  applying  abuse  control  of  powerful  or  dominant 
market  positions  with  regard  to  whether  the  addressees’  current  competitive  behaviour 
at  the  time  of  assessment  is  controlled  by  competitors’  general  supply-side 
substitution.306 

302  On  this  basis,  Snapchat  is  not  included  in  this  case.  Leaving  technological  aspects  and 
the  required  investments  aside,  which  could  make  supply-side  substitution  at  short 
notice  difficult,  there  is  also  reason  to  doubt  that  Snapchat  would  be  willing  and  able  to 
change  its  product  and  company  philosophy  to  turn  itself  into  a  social  network  offering 
a  user  experience  similar  to  Facebook.com.  Snapchat’s  service  became  successful 
because  it  offered  ephemeral  snaps  which  were  deleted  by  default  after  a  short  while. 
Snapchat  founder  Evan  Spiegel  said  that  Snapchat  was  all  about  “showing  who  I  am 


302  Federal  Court  of  Justice,  decision  of  16  January  2007,  ref.  KVR  12/06  ,  BGHZ  170,  299-311  -  National 
Geographic  II,  para.  20  (juris). 

303  of.  in  particular  Commission  Notice  on  the  definition  of  relevant  market  for  the  purposes  of  Community 
competition  law,  OJ  of  9  December  1997,  C  372/5,  para.  20. 

304  Federal  Court  of  Justice,  decision  of  21  December  2004,  ref.  KVR  26/03  -  Deutsche  Post/Trans-o-flex,  para.  28 
(juris). 

305  European  Commission,  Notice  on  the  definition  of  relevant  market  for  the  purposes  of  Community  competition 
law,  OJ  of  9  December  1997,  C  372/5,  para.  20,  22,  23. 

306  Federal  Court  of  Justice,  judgement  of  24  January  2017,  ref.  KZR  47/14,  “VBL  Gegenwert  ll“,  para.  25. 
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now”.307  The  fact  that  the  snaps  are  ephemeral  lowers  users’  inhibitions  to  share 
unfavourable  photos  of  themselves.  According  to  Snapchat,  it  is  part  of  the  company’s 
philosophy  to  facilitate  real  time  communication  which  is  as  realistic  as  possible.  The 
company  holds  that  real-life  conversations  are  also  ephemeral,  which  would  lead  to 
more  casual  behaviour  than  in  recorded  conversations.308With  its  short-lived  contents, 
Snapchat  is  particularly  popular  among  young  users.309 

303  In  contrast  to  that,  a  social  network  requires  long-term  user  relationships  rather  than 
short-lived  posts.  Long-standing  active  users  use  their  social  network  like  a  diary.  They 
save  photos  and  contents  permanently  and  can  display  them  in  chronological  order  if 
they  wish,  which  is  supported  by  the  fact  that  Facebook. corn’s  newsfeed  displays  both 
current  and  selected  past  posts  (“rediscover  shared  contents  and  posts”).  Not  even 
Snapchat’s  new  functions  “Snapchat  Memories”  or  “Snapchat  Stories”  are  aimed  at 
providing  users  with  a  similar  kind  of  experience.  Like  snaps,  Snapchat  stories  are 
“ephemeral”  and  disappear  24  hours  after  publication.  Snap  Inc.  deliberately  focuses 
its  service  on  its  users’  “closest”  friends  and  thus,  according  to  its  own  statements,  does 
not  plan  on  expanding  its  network  functions  to  “friends  of  friends”  or  “social  hooks”  like 
“Like”  buttons.  The  service  is  to  focus  on  active  communication  with  the  users’  “real” 
friends.310  That  being  said,  it  is  not  to  be  expected  that  Snapchat  will  simply  modify  its 
service  and  add  further  functions  to  turn  it  into  a  social  network  that  is  used  in  a 
completely  different  way.  As  outlined  above,  the  service  is  rather  a  competitor  of 
WhatsApp  and  Instagram. 

304  Contrary  to  Facebook’s  view,  a  “critical  mass”  of  users  or  technological,  financial  or 
personal  skills  are  not  an  indication  of  supply-side  substitution.  It  cannot  generally  be 
assumed  that  large  platforms  and  services  are  capable  any  time  of  entering  closely 
related  markets  and  being  as  successful  as  on  the  first  market,  making  them  current 
competitors  in  various  internet-related  markets.  Conversely,  the  services’  scope  cannot 
be  “transferred”  to  other  services.  While  it  may  be  technically  feasible  to  switch  or 
expand  to  another  product,  the  service  starts  from  scratch  in  terms  of  the  “critical  mass”, 
as  was  illustrated  by  the  example  of  Google+.  This  is  especially  true  for  products 
completely  changing  their  underlying  philosophy,  as  would  be  the  case  here.311  In 


307  http://www.n-tv.de/wirtschaft/Das-ist-der-Mann-der-Facebook-narrt-article19683262.html  fin  German,  last 
accessed  on  10  January  2019),  [...] 

308  [...]  Snapchat,  Form  S-1  Registration  Statement  of  2  February  2017,  p.  65, 
httpsV/www.sec.aov/Archives/edaar/data/l  564408/0001 1931251 70291 99/d27021 6ds1  ,htm#rom27021 6  4 

(last  accessed  on  10  January  2019),  [...] 

309  http://www.faz.net/aktuell/finanzen/soziales-netzwerk-snapchat-plant-boersenqanq-14780859.html  (in 

German,  last  accessed  on  10  January  2019),  [...] 

310  [■■■] 

311  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016,  p.  43. 
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addition,  this  also  applies  in  particular  with  regard  to  the  strong  direct  network  effects 
which  keep  users  with  Facebook.com  and  WhatsApp  and  which  form  a  considerable 
barrier  to  market  entry,  as  a  newly  formed  service  would  have  to  convince  current 
Facebook  users  to  switch.  Facebook  had  developed  the  “Poke”  app  [...],  which  served 
to  share  contents  that  disappeared  within  seconds  after  being  read.  Poke  [...] 
discontinued  in  201 4. 312  According  to  Facebook,  the  company  has  unsuccessfully  tried 
to  compete  in  further  markets,  but  discontinued  these  efforts313,  which  shows  that  not 
even  Facebook  can  transfer  its  user  base  to  another  closely  related  network  market. 

305  Facebook  gave  a  few  examples  of  successful  developments  by  other  services,  namely 
of  photo  service  Flickr  successfully  developing  an  online  game,  or  gaming  platform 
Slack  successfully  developing  communication  software  and  YouTube  successfully 
developing  a  video  dating  platform.  Flowever,  none  of  these  examples  are  relevant  in 
the  context  of  social  networks.314  In  individual  cases,  a  good  service  can  quickly 
become  successful,  which  is  a  characteristic  feature  of  internet  dynamics.  Flowever, 
internet  dynamics  and  innovative  power  as  such  cannot  be  used  to  justify  supply-side 
substitution,  which  can  actually  be  limited  in  individual  cases.  This  applies  in  particular 
to  the  lock-in  effect  on  the  targeted  user  group  due  to  direct  network  effects  (see  also 
460ff.).  There  is  reason  to  doubt  that  Snapchat  already  has  a  “critical  mass”  of  users  in 
Germany,  which  would  enable  the  company  to  switch  its  offer  towards  a  social  network. 
According  to  press  information,  approx.  5  million  users  in  Germany  use  Snapchat  (June 
2017).  The  number  of  daily  active  Facebook  users  is  considerably  higher  and 
amounted  to  approx.  23  million  in  201 7. 315  5%  of  the  users  questioned  during  the  user 
survey  commissioned  by  the  Bundeskartellamt  said  they  use  Snapchat  on  a  regular 
basis. 

306  It  can  ultimately  be  left  open  whether  Snapchat  is  to  be  included  in  the  market,  as  the 
competitive  assessment  would  not  change  as  a  result.  Flowever,  to  be  consistent,  the 
Facebook  services  Instagram  and  WhatsApp  would  have  to  be  included  as  well.  These 
have  considerably  larger  user  numbers  than  Snapchat.  Contrary  to  Facebook’s316  view, 
the  fact  that  the  European  Commission  classified  WhatsApp  as  a  messaging  service 
in  201 4  does  not  substantiate  the  view  that  Snapchat  and  WhatsApp  belong  to  separate 
markets.  Like  the  Bundeskartellamt,  the  Commission  distinguished  between  social 
networks  and  messaging  services  based  on  the  comprehensive  social  user  experience, 


312 

313 

314 

315 


[...] 

[...] 

[...] 

http://www.horizont.net/tech/nachrichten/Hansestaclt-Snapchat-Mutter-bezieht-ihren-Deutschlandsitz-in- 

Hamburg-158683:  (in  German,  last  accessed  on  10  January  2019);  [...] 
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real-time  communication  and  social  functionalities  in  a  larger  user  group.317  These 
differences  continue  to  apply  to  Snapchat  despite  the  additional  functionalities,  which 
is  why  the  Bundeskartellamt  holds  that  the  service  is  a  photo-based  messenger  service 
like  WhatsApp. 

v.  YouTube,  Twitter 

307  Contrary  to  Facebook’s  view318,  YouTube  and  Twitter  are  not  part  of  the  social  network 
market,  either. 

308  While  there  are  some  overlaps  with  Facebook.com  when  it  comes  to  functionalities, 
there  are  major  differences  with  regard  to  the  purposes  for  which  the  services  are  used, 
the  providers’  positioning  and  the  functionalities  offered  to  this  end,  which  contradict 
substitutability  with  Facebook.com  from  the  users’  perspective. 

•  YouTube 

309  Contrary  to  Facebook’s  view319,  this  primarily  applies  to  the  YouTube  service,  which  is 
first  and  foremost  a  video  platform  for  watching  and  exchanging  videos.  YouTube 
considers  itself  primarily  a  “video-on-demand”  platform  which  offers  some  “social” 
functions,  as  users  can  watch,  rate  and  share  videos.320  The  strategic  orientation  of 
video  platforms  like  YouTube  is  completely  different  from  social  networks  which 
emphasise  interactive  communication  between  users  in  a  virtual  social  space.  Only  4% 
of  the  users  questioned  counted  YouTube  among  the  services  they  use  as  “social 
networks”,  also  79%  of  them  actually  use  YouTube.321 

310  The  fact  that  the  exchange  of  videos  and  the  communication  processes  take  place 
between  two  separate  user  groups  rather  than  within  each  user  group  shows 
YouTube’s  strategic  orientation  as  a  video  platform.  The  focus  is  on  its  platform 
characteristics,  which  enable  direct  interaction  between  the  users  uploading  the  videos 
(the  “creators”)  and  the  users  who  watch  the  videos.  Users  can  subscribe  to  the 
creators’  “channels”.  The  service  is  mainly  characterised  by  the  indirect  network  effects 
which  exist  between  these  user  groups.  YouTube  has  turned  into  a  marketing  platform 
for  artists  which  generates  its  own  stars.  Artists  post  their  videos,  which  in  turn  generate 
considerable  advertising  revenue.  A  central  element  of  YouTube’s  business  model  is 
to  have  the  largest  possible  number  of  “creators”  on  the  platform.  YouTube  offers 
special  partnership  models  to  support  particularly  successful  “creators”  for  this 


317  European  Commission,  decision  of  3  October  2014,  Ref.  COMP/M. 721 7  -  para.  53  ff.  -  Facebook/WhatsApp 

318 
319 

320  [  ] 

321  [■] 


89 


purpose.322  Besides,  YouTube  has  a  special  incentive  structure  which  also  attracts 
private  users.  Unlike  social  networks  for  private  networking  with  friends,  they  can 
potentially  generate  significant  advertising  revenue  with  their  own  videos  on  YouTube. 

311  On  YouTube,  communication  between  the  channel  subscribers  is  limited  to  public 
comments  to  which  everyone  can  post  a  public  reply.  Until  August  2017,  however, 
sharing  videos  on  YouTube  was  not  possible.  Users  had  to  share  them  via  e-mail  or 
interfaces  with  other  services  like  Facebook.com  and  WhatsApp  before  that  date.  In 
August  2017  YouTube  launched  its  own  messaging  service  and  integrated  it  into  the 
mobile  YouTube  smartphone  app  which  facilitates  sharing  and  chatting  about  videos 
with  contacts  from  the  users’  contact  lists,  either  bilaterally  or  in  groups.  This  app  was 
created  to  modernise  the  process  of  sharing  YouTube  contents.  Users  can  now  share 
videos  directly  with  their  friends  while  continuing  to  watch,  browse,  discover  new 
contents  or  add  their  own  videos.  A  desktop  version  of  the  app  was  launched  in  June 
201 8. 323  Flowever,  this  chat  function  does  not  make  the  platform  part  of  the  social 
network  market.  Instead,  it  gives  access  to  the  messaging  services  market.  As  outlined 
above,  the  fact  that  some  social  network  providers  also  offer  messaging  services,  e.g. 
the  Facebook  Messenger,  WhatsApp  or  Google  Flangouts,  does  not  make  these 
services  substitutes  of  social  networks. 

312  Based  on  the  indicated  applications,  the  user  survey  has  shown  that  YouTube  thus 
does  not  work  like  a  virtual  social  space  digitally  reflecting  the  user’s  social 
relationships.  Many  users  mostly  use  YouTube  for  “entertainment  and  pastime”.324 
YouTube  is  hardly  ever  used  for  other  purposes  (e.g.  contacts  to  friends,  messaging, 
looking  for  people  the  user  knows,  share  contents)  [...]325  All  in  all,  this  shows  that 
YouTube  is  an  imperfect  substitute  for  Facebook.com.  YouTube  primarily  serves  to  find 
relevant  contents  and  entertainment,  while  entertainment  only  accounts  for  a  small 
fraction  of  the  applications  for  which  Facebook.com  is  used. 

313  The  time  spent  on  YouTube  compared  to  Facebook.com  confirms  this  statement: 
Providing  a  virtual  social  space,  Facebook. corn’s  daily  usage  is  high,  while  YouTube  is 
used  less  often.  Users  gave  the  following  information  on  their  usage  times  in  the  survey: 


https://voutube.qooqlebloq.com/2017/08/introducinq-new-wav-to-share-voutube.html  (last  accessed  on  10 
January  2019);  reply  to  the  Decision  Division’s  questions  of  12  June  2018,  [...] 

[...] 

[...] 
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YouTube 

Facebook 

Is  used 

79% 

58% 

of  which: 

more  than  once  per  day 

10% 

49% 

once  per  day 

8% 

16% 

several  times  a  week 

23% 

11% 

once  a  week 

12% 

6% 

several  times  a  month 

16% 

5% 

approx,  once  a  month 

15% 

6% 

less  often  than  that 

17% 

8% 

314  Viewing  YouTube  videos  is  normally  not  subject  to  registration.  A  significant  number  of 
daily  active  YouTube  users  use  the  service  without  registration,  which  means  that  they 
can  view  all  the  videos,  but  cannot  use  any  further  functionalities.326  This  also 
demonstrates  that  the  passive  consumption  of  videos  clearly  takes  priority.  YouTube 
refers  to  its  users  as  “viewers”  and  registers  usage  figures  classified  according  to  the 
categories  “daily  active  viewers”  (DAV)  and  “monthly  active  viewers”  (MAV). 
Consequently,  videos  are  the  only  type  of  media  which  can  be  uploaded.  YouTube  has 
no  upload  functions  for  audio  files  or  photos.  Upon  registration,  users  can  start  their 
own  YouTube  channel,  including  a  channel  icon,  and  enter  a  detailed  channel 
description  under  “About”.  However,  there  are  normally  no  detailed  user  profiles. 

315  The  assessment  that  YouTube  is  not  a  social  network327  is  not  changed  by  the  fact 
Facebook.com  launched  the  “Facebook  Watch”  (US  only)  and  “Facebook  for  Creators” 
functions  in  2017,  which  have  certain  overlaps  with  YouTube’s  business  model.328 
Video  functionalities  only  account  for  a  fraction  of  Facebook. corn’s  overall  network 
functions  as  part  of  a  comprehensive  user  experience,  i.e.  an  offer  of  video  contents. 
Facebook.com’s  entering  the  video  platform  market  does  not  make  YouTube  a  part  of 
the  social  network  market. 

316  Neither  can  YouTube  be  included  in  the  market  in  view  of  possible  supply-side 
substitution.  The  arguments  on  Snapchat  (para.  295ff)  apply.  In  addition,  it  cannot  be 


326  [...] 
327  [■■■] 
[■■■] 
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expected  that  YouTube  will  be  successful  on  the  social  network  market  in  the  short 
term  with  reasonable  economic  effort,  as  it  developed  its  large  user  basis  with  a 
completely  different  underlying  philosophy.  Google’s  own  company  history  has  shown 
this:  In  2013,  Google  tried  to  link  the  use  of  YouTube  to  the  use  of  its  social  network 
Google+.  A  Google+  registration  including  a  user  profile  was  required  for  posting 
comments  on  YouTube.  YouTube  users  massively  protested  against  this.329  In  autumn 
2015,  Google  reversed  the  practice.330 

317  It  also  has  to  be  considered  that  Google  already  had  its  own  social  network,  Google+, 
which  was  set  up  to  compete  with  Facebook.com  but  failed.  As  stated  above,  Google 
now  operates  Google+  as  a  business  product  only.  It  is  not  evident  that  Google  could 
intend  to  develop  YouTube  into  a  second  social  network,  which  would  potentially  put 
YouTube’s  recipe  for  success  as  a  video  platform  at  risk.  As  described  in  para.  276, 
the  problem  of  direct  network  effects  has  to  be  taken  into  account.  YouTube  rather 
pursues  the  audio-visual  development  of  its  platform  and  now  offers  subscription 
models  subject  to  fees.  In  June  2018,  YouTube  launched  its  music  streaming  service 
“YouTubeMusic”  in  Germany.331  There  are  two  options  to  use  the  service:  either  for 
free  with  advertising  or  as  a  premium  service  for  a  monthly  fee  of  9.99  euros.  At  the 
same  time,  “YouTube  Premium”,  an  advertising-free  premium  version  of  YouTube  that 
had  already  been  available  in  the  US,  was  launched  in  Germany  for  a  monthly  fee  of 
11.99  euros.332  With  this  strategy,  YouTube  moves  even  further  away  from  social 
networks. 

318  Contrary  to  Facebook’s  view,  parallel  use  (multi-homing)  of  Facebook.com  and 
YouTube  does  not  support  the  argument  of  a  single  product  market.  [,..]333[...]334  [...] 
Facebook.com  and  YouTube  are  increasingly  used  in  parallel,  [,..]335.  That  being  said, 
the  parallel  use  does  not  take  place  for  direct  communication  processes  with  friends 
and  acquaintances.  As  stated  earlier,  a  large  number  of  “DAVs”  uses  YouTube  without 
registration  and  thus  solely  for  viewing  videos. 


329  https://voutube.aooqleblog.com/2015/07/voutube-comments.html  (in  German,  last  accessed  on  10  January 
2019),  [...] 

330  f...1https://qooqlebloq. bloqspot.de/2015/07/everythinq-in-its-riqht-place.html  (last  accessed  on  10  January 
2019),  [...] 

331  Cf.  https://www.heise.de/newsticker/meldunq/Musik-Streaminq-YouTube-Music-startet-  in-Deutschland- 

4084187.html  (available  in  German  only,  last  accessed  on  10  January  2019). 

332  Cf.  https://www.heise.de/newsticker/meldunq/Gooqle-startet-Streaminq-Dienst-YouTube-Music-4050846.html 

(available  in  German  only,  last  accessed  on  10  January  2019). 
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•  Twitter 

319  From  the  users’  perspective  and  based  on  the  application  and  form  of  use,  the  Twitter 
service  is  not  part  of  the  market  for  social  networks,  but  can  at  most  be  considered  as 
substitute  competition. 

320  While  Twitter  users  can  set  up  a  detailed  profile  stating  their  age,  sex,  occupation  and 
general  interests336,  and  also  check  their  contact  list  against  the  service  to  see  which 
of  their  contacts  are  active  there337,  they  cannot  develop  an  online  identity  or  connect 
with  friends  or  people  they  know  to  exchange  experiences,  opinions  and  contents 
among  a  group  of  people  defined  by  themselves. 

321  Twitter  is  often  categorised  as  a  so-called  “microblogging”  (short  message)  service.  A 
“blog”  is  a  journal  which  is  typically  kept  on  a  website  and  normally  publicly  accessible. 
A  person  referred  to  as  “blogger”  uses  the  blog  as  a  log  or  enters  contents  such  as 
photos  or  videos,  or  simply  makes  notes  of  his/her  thoughts.  “Microblogging”  means 
blogging  by  posting  short  status  messages  which  typically  do  not  exceed  a  length  of 
200  characters.  As  described  above  (see  para.  203),  registered  users  can  use  Twitter 
to  share  short,  telegram-style  messages  (“tweets”)  not  exceeding  a  length  of  280 
characters  (excluding  attached  files  or  quoted  tweets).  The  service  thus  has  similar 
functions  as  a  messaging  service  due  to  the  real-time  tweets  and  its  overall  quickness 
of  response.  [...]  Twitter  focuses  on  real-time  information  on  current  developments 

j-  ]338 

322  Unlike  social  networks,  the  service  is  also  characterised  by  highly  visible  public  tweets. 
Tweets  are  public  by  default.  While  users  can  also  decide  to  share  their  information 
bilaterally  or  in  a  small  group  of  users,  the  service  considers  itself  primarily  a  platform 
for  public  self-promotion  and  real-time  exchange  [...j.339  Twitter  emphasises  that,  in 
contrast  to  the  service  provided  by  its  competitors,  users  can  also  see  tweets  from 
users  they  do  not  know.340  A  key  feature  of  Twitter  is  the  hashtag  (#)  which  serves  to 
find  public  tweets.  Frequently  used  hashtags  are  potential  “trending  topics”  in  public 
debate. 

323  Another  area  of  focus  of  this  service  is  content  sharing.341  As  detailed  above,  the 
“content-sharing  services”  category  is  often  found  among  the  various  social  media 


336  [■  ] 

337  Twitter,  https://twitter.com/who  to  follow/import  (last  accessed  on  27  July  2018);  similar  procedure  with  the 
services  Weheartit  and  Instagram. 

338  [  ] 

339  [  ] 
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definitions.342  Internet  platforms  are  focused  on  the  publication  of  contents  and 
interactions  between  users  and  contents.343  The  (smaller)  group  of  “creators”  is 
normally  confronted  with  a  larger  user  group  which  consumes  and  comments  on  the 
contents  published  by  the  creators.  However,  content-sharing  platforms  lack  social 
functions  exceeding  the  scope  of  comments/likes.344  On  Twitter,  users  who  do  not  know 
each  other  frequently  exchange  opinions  and  contents.  The  users’  identity  does  not 
matter  to  the  same  extent  as  it  does  on  social  networks.  The  volume  and  relevance  of 
the  contents  posted  on  the  platform  are  the  important  criterion.345 

324  As  a  content  platform,  Twitter  is  thus  comparable  to  YouTube,  which  is  also  often 
classified  as  “content-sharing”  platform.  As  on  YouTube,  users  can  look  at  contents 
without  registration  on  Twitter.346  Users  only  have  to  register  if  they  want  to  interact  with 
other  users,  e.g.  to  comment  on  certain  contents  or  to  “follow”  them. 

325  Twitter  also  cannot  be  classified  as  a  social  network  on  the  basis  of  the  time  spent  on 
the  service: 


YouTube 

Facebook 

Twitter 

Is  used 

79% 

58% 

15% 

of  which: 

more  than  once  per  day 

10% 

49% 

12% 

once  per  day 

8% 

16% 

6% 

several  times  a  week 

23% 

11% 

15% 

once  a  week 

12% 

6% 

10% 

several  times  a  month 

16% 

5% 

9% 

approx,  once  a  month 

15% 

6% 

18% 

less  often  than  that 

17% 

8% 

31% 

326  The  users’  replies  show  that  Twitter  is  used  in  a  way  that  rather  compares  to  YouT ube, 
although  it  has  considerably  fewer  users  who  more  frequently  said  they  would  rarely 
use  the  service.  This  is  another  aspect  under  which  this  service  cannot  be  considered 


342  See  for  example  the  definition  by  the  German  Association  for  the  Digital  Economy  (BVDW), 

https://www.bvdw.ora/fileadmin/bvdw/upload/publikationen/social  media/Kompass  Social  Media  2016  2017. 

pdf  (in  German,  last  accessed  on  10  January  2018):  Content-sharing  services  allow  users  to  share  content, 
e.g.  photos,  videos  or  music,  with  other  users,  who  can  rate,  recommend  or  link  it. 
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346  www.twitter.de  (in  German,  last  accessed  on  10  January  201 9), [...];  www.voutube.de  fin  German,  last  accessed 
on  10  January  201 9), [...];  similar  for  WeHeartit;  the  use  of  Pinterest  and  Tumblr  is  subject  to  registration. 
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a  virtual  social  space  for  users  that  would  enable  them  to  gather  and  interact  with 
various  friends  and  groups. 

327  Another  indication  that  there  is  no  substitutability  with  Facebook.com  is  [...]  that 
Facebook’s  market  entry  did  not  have  any  influence  on  Twitter’s  market  position  in 
Germany  [,..].347  Like  Snapchat  and  YouTube,  Twitter  cannot  be  included  under  the 
assumption  of  potential  supply-side  substitution.  As  detailed  above,  it  cannot  be 
assumed  that  the  service  intends  to  change  its  application  in  the  short  term,  expecting 
to  keep  its  user  base. 

vi.  Pinterest,  Instagram 

328  Contrary  to  Facebook’s  view,  Pinterest  and  Instagram  are  not  part  of  the  social  network 
market. 

•  Pinterest 

329  On  its  German  website,  Pinterest  describes  itself  as  a  “catalogue  of  ideas  people  use 
to  plan  the  big  and  small  projects  of  their  lives”.348  Pinterest  claims  to  be  a  “visual 
bookmark”  helping  users  find  and  organise  creative  ideas.349 

330  Online  media  classify  the  service  as  a  “social  network  of  pictures”  that  is  counted 
among  the  microblogging  platforms.  Users  can  pin  pictures,  photos  and  drawings  to 
their  virtual  boards  and  make  them  available  either  to  the  public  or  to  defined  groups. 
The  service’s  name  is  a  composition  of  the  verb  “to  pin”  and  “interest”.  To  register,  they 
need  to  enter  their  name  and  e-mail  address  and  select  from  a  variety  of  different  areas 
of  interest  (photography,  fashion,  shoes,  food  and  drink,  home  and  living  etc.).  Use  of 
the  service  is  subject  to  registration.  The  “home”  page  (“start”  feed)  shows  various 
photos  made  available  by  commercial  or  private  boards  on  the  selected  topics.  Pins 
can  be  saved  to  the  users’  boards,  which  can  be  marked  as  “secret”  if  required.  Pins 
can  be  shared  (“repinned”)  and  commented  on  in  other  social  media.  (Real-time) 
conversations  can  also  take  place  via  the  message  function.  Other  users  can  be  invited 
to  jointly  collect  pins  on  a  separate  board.  Users  can  follow  all  or  selected  boards  of 
other  users. 

331  Based  on  its  application  and  characteristics,  Pinterest  is  not  part  of  the  social  network 
market.  The  service  rather  focuses  on  collecting,  organising  and  viewing  commercial 
and  private  photos,  with  relatively  limited  communication  on  them.  Commercial  pins 
appear  in  large  numbers  on  the  start  feed  based  on  the  interests  the  user  indicated. 


347  [■■■] 

348  Cf.  description  of  the  smartphone  app  in  Apple’s  app  store,  accessed  on  21  August  2017. 

349  Cf.  (German)  description  in  Pinterest’s  help  centre,  https://help.pinterest.com/de/auide/all-about-pinterest.  [...] 
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They  serve  to  collect  shopping  ideas  and  as  product  advertisements.  In  the  area  of 
private  interests,  Pinterest  can  be  used  for  “photo  blogging”,  which  is  a  mixture  of 
blogging  and  content  sharing. 

332  The  user  survey  confirms  this  view.  Only  2%  of  the  users  said  they  used  Pinterest  as 
a  “social  network”,  while  11%  actually  used  Pinterest.350  This  is  already  an  indication 
that  users  do  not  consider  the  service  a  social  network.  When  it  comes  to  the  various 
applications,  the  respondents  named  Pinterest  at  best  as  their  second  most  frequently 
used  service,  and  only  a  small  share  of  them  ranked  the  service  that  high.  Only  4%  of 
the  Pinterest  users  said  Pinterest  was  their  second  most  used  service  for 
“entertainment  and  pastime”.  An  even  smaller  share  of  Pinterest  users  named  Pinterest 
their  second  most  used  service  for  following  “brands  and  celebrities”  or  “obtaining 
information  on  events  or  products”  (less  than  1%  in  each  case).  The  time  spent  on 
Pinterest  is  similar  to  other  content  platforms  like  YouTube  or  Twitter: 


YouTube 

Facebook 

Pinterest 

Is  used 

79% 

58% 

11% 

of  which: 

more  than  once  per  day 

10% 

49% 

9% 

once  per  day 

8% 

16% 

11% 

several  times  a  week 

23% 

11% 

13% 

once  a  week 

12% 

6% 

6% 

several  times  a  month 

16% 

5% 

15% 

approx,  once  a  month 

15% 

6% 

19% 

less  often  than  that 

17% 

8% 

28% 

333  All  in  all,  this  service  thus  cannot  be  considered  a  virtual  social  space  for  users  to  gather 
and  interact  with  various  friends  and  groups.  As  with  other  services,  Pinterest  cannot 
be  included  under  the  assumption  of  potential  supply-side  substitution  either.  As 
detailed  above,  it  cannot  be  assumed  that  the  service  would  be  willing  or  able  to  change 
its  application  in  the  short  term  while  expecting  to  keep  its  user  base. 

•  Instagram 

334  Contrary  to  Facebook’s  view,  Instagram  is  not  a  social  network  which  could  be 
considered  a  potential  substitute  for  Facebook.com,  despite  the  fact  that  there  are 


350  [  ] 
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certain  overlaps  and  links  between  the  two  services.  Instead,  it  is  a  mobile  photo 
service  with  a  microblogging  function,  putting  the  service  in  a  competitive  position  to 
Snapchat  on  the  one  hand  and  YouTube  on  the  other. 

335  Instagram  contains  some  key  elements  of  a  social  network,  e.g.  the  obligation  to 
register  and  options  to  create  a  relatively  comprehensive  user  profile.  Users  can  look 
for  people  they  want  to  follow  and  “followers”  can  follow  them.  Contacts  from  their 
address  books  can  be  uploaded  to  see  if  they  use  the  service  too.  If  Instagram  users 
also  use  Facebook,  their  Facebook  friends  can  follow  them  on  Instagram  if  they  also 
use  that  service.  With  its  “Discover  People”  function,  Instagram  suggests  other  users 
and  also  accesses  Facebook  data  for  this  purpose.  The  service  also  has  a  start  page 
listing  the  photos  and  videos  posted  by  the  people  a  user  follows.  The  service  is  also 
used  by  a  significant  number  of  companies  and  celebrities,  and  users  can  follow  them 
too. 

336  With  communication  being  limited  to  photos  and  videos,  the  service  cannot  be 
classified  as  a  social  network.  The  service  is  rather  to  be  placed  among  the  content 
platforms,  as  its  attractiveness  is  mostly  based  on  the  number  and  relevance  of  the 
posted  contents  and  to  a  lesser  extent  on  the  private  users’  identities.  While  it  is  now 
possible  to  create  a  “private  account”  which  is  only  visible  to  users  the  owner  approved, 
Instagram  has  been  created  for  public  use  which  generates  more  “followers”. 
Instagram’s  incentive  structure  is  similar  to  YouTube’s,  as  users  can  make  their 
accounts  available  as  advertising  channels.  If  they  generate  enough  followers,  they 
receive  advertising  revenues.  “Product  placement”,  for  example,  can  generate 
advertising  revenue.  Users  take  pictures  of  a  certain  product  and  upload  them  to  their 
Instagram  account.  Such  potential  advertising  revenue  is  a  significant  incentive  for 
having  a  public  account. 

337  As  on  YouTube,  some  Instagram  stars  are  only  known  on  this  specific  platform.  The 
large  number  of  celebrities  on  Instagram  makes  the  service  interesting  for  so-called 
influencer  advertising.  Influencers  are  active  in  social  media  and  have  the  potential  to 
generate  revenue  with  advertising  and  marketing  due  to  the  influence  they  have  gained 
on  their  followers  with  their  strong  presence  and  reputation,  content  product  and 
distribution.  They  are  also  used  for  marketing  purposes  in  the  respective  social  media. 

338  In  a  private  context,  the  service  functions  as  an  online  photo  diary  and,  like  Snapchat, 
it  has  a  photo  chat  function  including  options  to  edit  photos  before  sending  them. 
Additionally,  Instagram  “stories”  can  be  created.  The  service  can  also  be  used 
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exclusively  as  a  mobile  app  or  mobile  website.  37%  of  Instagram  users  are  14  to  19 
years  old.351 

vii.  Other  services 

339  Other  services  considered,  e.g.  Apple  Photos,  Flickr,  MySpace,  Reddit,  Tumblr,  Vimeo 
and  Yelp  are  not  to  be  included  in  the  relevant  market  for  social  services  either. 

340  Flickr  is  a  photo  service  with  blogging  function  offering  similar  functionalities  and 
applications  to  Pinterest  and  Instagram.  It  is  thus  not  to  be  categorised  as  a  social 
network.  The  explanations  on  Pinterest  also  apply  in  this  case.  Apple  Photos  is  not  to 
be  included  either.  There  is  reason  to  doubt  that  the  service  actually  is  a  social  medium 
at  all  as  the  only  communication  option  it  offers  is  sharing  photos  via  other  social  media. 

341  Tumblr  is  also  a  blogging  service  focusing  on  photos.  However,  like  Reddit,  its 
applications  and  functions  are  comparable  to  Twitter.  The  services  are  used  for  public 
communication  only,  with  Tumblr  lacking  a  comments  function.  Both  services  are  also 
mostly  in  English  and  cannot  be  attributed  to  the  social  network  market  for  the  same 
reasons  applying  to  Twitter. 

342  Like  YouTube,  the  Vimeo  portal  cannot  be  attributed  to  the  same  market  as 
Facebook.com.  The  explanations  on  YouTube  also  apply  in  this  case.  What  is  more, 
most  parts  of  the  service  are  subject  to  fees  and  address  a  professional  user  group. 
My  Space  is  not  attributable  to  the  social  network  market  either.  The  service  has  a 
clear  focus  on  music  and  mostly  serves  for  marketing  and  raising  awareness  tor 
musicians  and  bands  as  well  as  helping  musicians  stay  in  touch  across  borders.  The 
applications  of  MySpace  mostly  include  elements  of  content  platforms  like  YouTube, 
but  also  elements  of  a  professional  network  for  musicians. 

343  Finally,  the  online  business  guide  Yelp  and  similar  services  are  not  part  of  the  market 
either.  Users  use  these  services  for  other  purposes  than  those  of  social  networks.  They 
mostly  look  for  and  compare  service  or  product  offers  to  book  or  buy  them.  Other  users’ 
ratings  help  them  decide  which  offer  to  choose.  The  providers’  information  is 
complemented  by  the  perception  of  those  who  have  already  used  the  product  or 
service.  Many  users  benefit  from  these  ratings  as  these  potentially  offer  an  independent 
and  subjective  assessment  as  a  basis  for  comparing  one  product  offer  to  another. 
Some  of  the  services’  characteristics  are  similar  to  Pinterest,  which  is  not  part  of  the 
relevant  market  either. 


351  https://www.crowdmedia.de/social-media/instaaram-nutzerzahlen-in-deutschland-2018/  (in  German,  last 
accessed  on  1 0  January  201 9). 
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(3)  Geographic  market  definition 

344  The  geographic  social  network  market  area  is  Germany,  which  is  supported  by  the 
outcome  of  the  investigations  into  the  actual  use  of  social  networks  in  Germany  (see 
a)  and  the  existing  special  characteristics  in  Germany  (see  b).  Additionally,  the  market 
affected  by  the  conduct  does  not  extend  beyond  Germany’s  borders  for  reasons  of 
supply-side  substitution  (see  c). 

(a)  Actual  national  use 

345  With  the  actual  use  of  social  networks  being  mostly  limited  to  users  based  in  Germany, 
defining  the  market  as  Germany-wide  seems  appropriate. 

346  Social  networks  are  available  worldwide  and  both  Facebook.com  and,  while  the  service 
was  on  the  market,  Google+,  are  designed  for  international  use.  53%  of  the  users  said 
in  the  Bundeskartellamt’s  user  survey  that  their  decision  to  use  a  network  was  based, 
among  other  aspects,  on  the  criterion  that  “people  from  various  regions  or  countries” 
use  the  network  too.352  Facebook.com  and  the  former  Google-i-  service  are  attributable 
to  the  respective  domestic  markets,  irrespective  of  the  fact  that  there  are  also  networks 
(Stayfriends,  StudiVZ,  Jappy.de)  which  basically  focus  on  the  German  market.  In  fact, 
German  users  mostly  use  the  network  to  connect  with  their  Germany-based  friends. 

347  Flowever,  according  to  the  user  survey,  for  approx.  85%  of  the  users  the  decision  to 
use  a  social  network  is  based  on  the  fact  that  their  friends  also  use  the  social 
network.353  In  addition,  the  user  survey  showed  that,  with  respect  to  Facebook.com, 
approx.  80%  of  the  users  said  most  of  their  friends  lived  in  Germany,  approx.  1 5%  have 
friends  both  in  Germany  and  abroad  and  less  than  2%  said  most  of  their  friends  lived 
abroad.354  The  identity-based  network  effects  mentioned  above,  which  are  a  typical 
characteristic  of  social  networks,  thus  mostly  take  effect  within  the  national  borders,  as 
the  relevant  friends  of  more  than  three  quarters  of  all  users  are  located  within  these 
borders.  Network  effects  work  in  favour  of  social  network  providers  whose  networks 
have  a  large  user  base  in  Germany,  as  their  users  are  highly  likely  to  find  their  friends. 

(b)  National  specifics 

348  For  international  social  networks  like  Facebook.com  and  formerly  Google+,  the  user 
interface  has  the  same  design  worldwide.  Flowever,  their  services  are  offered  under  a 
national  domain  in  each  country.  Language  settings  also  vary  according  to  user  region. 


352  [...] 

353  [...] 

354  [..•] 
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Services  like  Odnoklassniki  (see  para.  192)  are  not  to  be  included  in  the  market  as 
German  users  would  not  find  other  users  mostly  communicating  in  their  language  on 
that  network,  so  social  interaction,  which  is  a  key  element  of  social  networks,  would  not 
be  possible.  Content  users  share  on  Facebook.com,  e.g.  by  clicking  “Like”  or  “Share”, 
is  often  in  German  as  it  refers  to  regional  or  national  topics  based  on  the  users’ 
interests.  The  same  applies  for  German-language  advertising  that  matches  the 
interests  of  German  users. 

349  German  users  use  Facebook.com  in  a  way  that  differs  from  other  European  countries. 

j-  J355 

(c)  Service  providers  unable  to  perform  supply-side  substitution 

350  Supply-side  substitution  from  other  national  markets  cannot  be  assumed  as  it  is  not 
possible  to  successfully  enter  the  German  market  from  other  geographic  markets  in  the 
short  term  and  at  reasonable  economic  cost  due  to  the  identity-based  direct  network 
effects  in  place.  The  users’  national  focus  when  using  a  network  makes  it  difficult  to 
expand  the  network's  geographic  orientation  and,  for  social  media  which  previously 
had  a  different  market  position,  it  is  equally  difficult  to  expand  their  scope  of  functions. 
This  type  of  market  entry  would  require  to  build  up  a  network  with  an  entirely  new  user 
base.  As  is  the  case  when  it  comes  to  transferring  a  network's  scope  to  a  newly 
developed  service,  it  is  not  possible  to  expand  the  existing  geographic  scope  with 
reasonable  economic  effort  in  the  short  term,  due  to  the  direct  network  effects. 

351  The  national  networks  Stayfriends  and  StudiVZ  have  thus  not  been  very  successful  in 
their  attempts  to  grow  in  other  European  countries:  StudiVZ  tried  to  expand  to  other 
European  countries  but  discontinued  its  efforts  in  2009. 356  Stayfriends  is  only  active  in 
the  German-speaking  area.  While  the  company  does  have  a  Swedish  (Stayfriends.se) 
and  a  French  branch  (Trombi.com),  these  are  separate  services  with  very  small  user 
numbers.357 

c.  Online  advertising  markets 

352  The  market  side  of  advertisers  on  Facebook.com  is  also  affected  by  the  conduct  under 
review.  The  advertisers  mainly  provide  targeted  advertising  for  which  a  considerable 
amount  of  data  has  to  be  processed.  As  has  been  outlined,  the  market  side  of  the 
advertisers  has  to  be  considered  separately  from  the  other  market  sides  of  the  social 


355  [  ] 

356  http://www.chip.de/news/StudiVZ-schliesst-fremdsprachiqe-Ableqer  34078550.html  [...] 

357  [■■■] 
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network.  The  affected  market  is  the  national  market  for  non-search  online  advertising. 
It  can  be  left  open  whether  a  submarket  for  non-search  social  media  advertising  exists. 

(1)  Definition  of  the  product  market 

353  According  to  the  Bundeskartellamt's  investigations,  online  advertising  and  offline 
advertising  are  separate  markets  (a).  When  it  comes  to  online  advertising,  product 
markets  for  search  and  non-search  online  advertising  have  to  be  differentiated  (b). 
According  to  the  Bundeskartellamt’s  investigations,  there  are  indications  that  non¬ 
search  online  advertising  can  be  broken  down  further  into  advertising  on  social  media 
or  networks,  particularly  Facebook.com,  and  other  non-search  advertising  (c). 

(a)  Online  vs.  offline  advertising 

354  The  Decision  Division’s  investigations  have  confirmed  what  the  Commission  and  the 
Bundeskartellamt  have  been  implementing,  namely  that,  from  the  customers’ 
perspective,  online  and  offline  advertising  need  to  be  differentiated. 358 

355  From  the  perspective  of  the  advertisers  and  media  agencies  questioned,  online 
advertising  has  some  significant  advantages  over  offline  advertising,  one  of  them  being 
that  online  advertising  provides  considerably  better  opportunities  to  address  the  target 
groups.  The  respondents  said  it  was  easier  to  identify  and  address  target  groups  online. 
Additionally,  they  found  online  advertising  to  be  beneficial  from  an  economic  point  of 
view  and  said  it  offered  a  better  return  on  investment  and,  all  in  all,  was  often  cheaper 
than  offline  advertising.  Additionally,  online  advertising  was  considered  to  be 
particularly  flexible,  quick  and  easily  scalable.  In  the  respondents'  view,  online 
advertising  also  offered  better  opportunities  to  measure  and  track  success.  Companies 
with  a  high  visibility  online  emphasised  that  online  advertising  facilitated  direct 
interaction  with  customers  without  having  to  switch  media.359 

356  As  to  the  disadvantages  of  online  advertising  compared  to  offline  advertising,  some  of 
the  companies  questioned  stated  the  fact  that  not  all  relevant  target  groups  could  be 
reached  online  to  a  sufficient  extent  (e.g.  women  over  65).  In  addition  it  was  also  stated 
that  the  environment  in  which  online  advertising  appears  is  difficult  to  control.  Some 


358  Cf.  e.g.  BKartA,  decision  of  1 1  June  201 5  -  B6-22/1 5  -  Funke/Springer/Media  Impact-  para.  21 3  ff.;  European 
Commission,  decision  of  18  February  2010  -  COMP/M. 5727  -  Microsoft/Yahoo!  Search  Business,  para. 61; 
decision  of  1 1  March  2008  -  COMP/M. 4731  -  Google/DoubleClick ,  para.  44  ff. 

359  j  j 
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companies  also  pointed  out  that  the  scope  of  online  advertising  was  not  as  wide  as  that 
of  offline  campaigns.  Fraud  issues  (“ad  fraud”360)  were  also  often  mentioned.361 

357  There  is  also  only  very  little  tendency  to  shift  online  advertising  budgets  to  offline 
advertising,  which  also  contradicts  the  argument  that  one  form  of  advertising  can 
substitute  the  other.362 

(b)  Search  and  non-search  advertising 

358  The  Bundeskartellamt’s  investigations  have  also  shown  that  search  and  non-search 
online  advertising  have  to  be  considered  as  separate  markets.  The  Commission  had 
previously  left  this  question  open  in  its  decisions.363  A  large  majority  of  the  advertising 
companies  surveyed  consider  search  advertising  a  form  of  advertising  that  is  separate 
from  online  advertising  in  general.364  According  to  the  surveyed  companies,  search 
advertising  has  a  number  of  specific  benefits  compared  to  other  forms  of  online 
advertising.  Search  advertising  plays  a  particular  role  when  it  comes  to  generating  and 
measuring  conversions,  i.e.  the  number  of  users  of  a  website  that  actually  buy  the 
product.  They  also  underline  the  high  relevance  search  advertising  has  for  customers. 
In  addition,  several  companies  surveyed  consider  search  advertising  a  particularly 
efficient  form  of  online  advertising.365 

359  Some  companies  said  that  the  different  types  of  online  advertising  addressed  different 
“funnels”,  i.e.  different  stages  of  a  customer’s  buying  process.  Search  advertising  is 
especially  relevant  at  the  last  stage  of  the  funnel,  i.e.  at  the  end  of  the  buying  process, 
while  non-search  advertising,  especially  display  and  social  media  advertising,  rather 
takes  place  at  the  first  stages  (“at  the  beginning  of  the  customer  journey”).  Other 
companies  consider  search  advertising  an  especially  effective  “pull”  channel  for  selling 
goods  to  customers  who  already  have  a  specific  demand.  Several  companies  also 
point  out  that  search  advertising  was  hardly  suitable  for  developing  brand  awareness 
or  generating  demand  for  a  certain  product  (“push  marketing”).366 

360  The  companies  surveyed  also  see  hardly  any  options  to  substitute  search  advertising, 
in  particular  advertising  on  Google  search,  which  is  considered  the  most  important 


360 

361 

362 

363 

364 

365 

366 


https://www.die-webseitenverbesserer.de/bloq/betruq-der-online-werbunq-ad-fraud-als-unterschaetztes- 

problem  (in  German,  last  accessed  on  10  January  2019). 


Cf.  COM  P/M. 4731  -  Google/DoubleClick ,  para.  48  ff. ;  COMP/M. 5727  -  Microsoft/Yahoo!  Search  Business , 
para.  62ff. 
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online  advertising  option.367  The  investigations  have  also  shown  that  price  increases 
for  search  advertising  do  not  lead  to  budget  shifts  to  other  forms  of  advertising.  Hence, 
the  price  sensitivity  for  search  advertising  and  the  fact  that  providers  of  search 
advertising  are  not  replaced  by  providers  of  non-search  advertising  also  support  the 
argument  that  separate  markets  exist. 

(c)  Possible  separate  market  for  non-search  advertising  on  social  media  or  social 
networks 

361  The  Bundeskartellamt’s  investigations  have  revealed  strong  indications  suggesting  that 
non-search  advertising  on  social  media  and  search  advertising  outside  social  media 
could  represent  separate  product  markets.  The  primary  reason  for  this  is  that, 
according  to  the  surveyed  companies,  the  two  forms  of  advertising  fulfil  different 
advertising  purposes.  The  companies  said  that  social  media  advertising  was  better 
suited  for  targeted  approaches  to  certain  target  groups  and  for  linking  advertising  to 
social  and  emotional  elements.  Further  benefits  indicated  include  the  minimisation  of 
scatter  losses  and  opportunities  for  cross-device  tracking.  There  are  also  indications  to 
suggest  that  there  is  a  separate  market  for  social  network  advertising  within  the  overall 
social  media  advertising  market. 

362  The  assumption  that  a  relevant  product  market  exists  for  non-search  advertising  on 
social  networks,  in  this  case  Facebook  in  particular,  is  supported  by  the  fact  that  the 
companies  surveyed  said  the  data  Facebook  collected  were  an  advantage  of  Facebook 
advertising  as  opposed  to  advertising  on  other  social  media  sites.  The 
Bundeskartellamt’s  investigations  have  shown  that  the  data  Facebook  collected  and 
made  available  for  advertising  purposes  were  considered  an  important  advantage  of 
advertising  on  Facebook  besides  the  service’s  wide  coverage.  11  out  of  13  media 
agencies  which  responded  to  the  questionnaire  said  that  advertising  on  Facebook 
offered  good  targeting  opportunities  or  very  detailed  user  data,  which  was  an 
advantage  over  other  social  media  services.368  A  large  number  of  advertisers  considers 
the  good  targeting  options  and  comprehensive  user  data  a  benefit  of  advertising  on 
Facebook.369  They  often  mentioned  as  advantages  that  data  specified  users’  interests, 
offered  very  fine-grained  details  and  user-based  profile  information. 


367 

368  [...] 

369  [•  ] 
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363  The  exact  market  definition  of  non-search  advertising,  however,  can  be  left  open  as 
Facebook’s  exact  position  on  these  markets  is  irrelevant  for  the  purposes  of  abuse 
control. 

(2)  Geographic  market  definition 

364  Based  on  the  general  practice  of  competition  authorities,  advertising  markets  are 
defined  as  national  markets.  This  makes  sense  in  view  of  language  aspects  and 
consumers’  national  preferences. 

d.  Markets  for  social  plug-ins,  central  log-ins  and  measurement  and  analysis 
services 

365  Facebook’s  data  processing  from  Facebook  Business  Tools  also  affects  markets  on 
which  Facebook  offers  social  plug-ins,  Facebook  log-in,  measurement  and  analysis 
services  and  other  developer  tools. 

366  As  detailed  above  (see  para.  365ff.),  the  services  stated  have  to  be  separated  from  the 
other  market  sides  (private  users,  publishers  and  advertisers).  It  seems  reasonable  that 
with  regard  to  the  individual  tools  and  products,  further  submarkets  can  be  assumed  to 
exist.  These  are  also  to  be  defined  as  national  in  view  of  the  fact  that  private  users  use 
the  social  networks  in  a  national  context,  and  the  products  are  linked  to  them. 

367  The  fact  that  the  services  are  available  free  of  charge  does  not  disqualify  them  as 
market  services.  Rather,  these  services  qualify  as  markets  pursuant  to  Section  18(2a) 
GWB  as  each  of  them  constitutes  a  market  side  of  the  platform,  which  serves  a  single 
business  purpose  with  its  advertising  revenue  and  fees.  They  all  utilise  the  wide 
coverage  generated  by  the  offer  of  their  social  media  or  other  services  for  private  and 
professional  users,  which  makes  it  attractive  for  websites  and  apps  to  use  the  tools 
connected  to  them.  When  using  the  tools,  in  particular  the  Facebook  Business  Tools, 
data  will  flow,  which  can  be  considered  a  compensation  for  using  the  tools. 

368  It  seems  reasonable  to  assess  social  plug-ins  which  are  integrated  into  websites  and 
apps  via  interfaces  and  and  allow  their  users  to  publish  and  spread  their  contents  on 
social  media,  as  a  market.  Especially  the  “Like”,  “Follow”  and  “Share”  buttons  serve  a 
single  purpose  and  are  offered  by  various  social  media.  Twitter  offers  tools  which  are 
similar  to  Facebook’s  plug-ins  (particularly  the  “Tweet”  and  “Follow”  buttons)370,  and  so 


370  https://developer.twitter.com/en/docs/twitter-for-websites/overview.html  (last  accessed  on  10  January  2019). 
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do  Pinterest  (“Pin  it”  button)371,  Xing  (“Share”  button)372,  Linkedln  (“Share”,  “Follow”)373 
and  many  other  services.  Many  websites  feature  more  than  one  of  these  interfaces. 

369  It  is  not  clear  whether  social  plug-ins  are  in  competition  with  one  another  or  whether 
they  complement  each  other.  The  social  plug-ins,  e.g.  the  “Follow”  button,  are  also 
often  a  link  to  the  publishers’  market  side  on  social  media.  In  individual  cases,  this  could 
be  an  argument  in  favour  of  treating  these  market  sides  as  one.  The  technical  platform 
on  which  the  plug-in  is  to  be  included,  i.e.  whether  it  is  designed  for  a  website  or  an 
app,  could  be  another  differentiating  criterion.  However,  the  exact  market  definition  can 
be  left  open  in  this  case. 

370  It  also  seems  obvious  that  there  is  a  separate  market  for  single-sign-on  services,  on 
which  Facebook  is  active  with  the  “Facebook  Log-in”.  Websites  and  apps  can  use  them 
to  facilitate  registration  with  their  own  services. 

371  Websites  and  apps  have  a  specific  interest  in  registered  users,  as  their  registration 
provides  them  with  identifying  user  data  which  can  be  complemented  by  further  data 
through  cookies.  With  this  data  websites  and  apps  can  create  larger  user  profiles 
themselves  and  offer  them  to  their  advertising  customers.  Users  benefit  from  a  very 
simple  registration  process  which  does  not  require  any  further  data  once  the  data  on 
the  existing  accounts  has  been  entered.  Besides  social  media  (e.g.  “Google  Sign 
In”374),  such  log-in  services  are  provided  by  major  trading  platforms  like  Amazon  Log¬ 
in  and  Amazon  Pay,  and  by  cooperations  of  web  services  like  the  “European  Net  ID 
Foundation”375  or  “Verimi”376. 

372  It  can  also  be  left  open  whether  further  submarkets  can  be  assumed  to  exist.  Such 
markets  could  be  defined  according  to  the  different  services  providing  the  user  base, 
which  can  have  completely  different  registration  data  sets. 

373  There  is  obviously  also  a  market  for  measurement  and  analysis  services  on  which 
Facebook  is  active,  in  particular  with  Facebook  Analytics,  but  also  with  Facebook  Pixel 
and  the  analyses  offered  by  this  tool.  Further  submarkets  could  be  defined,  e.g.  based 
on  the  criterion  of  whether  the  product  analyses  the  effect  and  success  of  the  specific 
ad  published  by  the  respective  supplier.  Facebook  offers,  for  example,  “conversion 


371  http://www.addthis.corn/social-buttons/pinterest/ ,  [...] 

372  https://dev.xing.com/pluqins/share  button  (last  accessed  on  1 0  January  201 9). 

373  https://developer.linkedin.com/pluains.  last  accessed  on  10  January  2019). 

374  https://developers.qooqle.com/+/web/siqnin/ ,  last  accessed  on  10  January  2019). 

375  Cf.  https ://enid.foundation/  (last  accessed  on  10  January  2019)  and 
https://www.wuv.de/medien/rtl  prosiebensat  1  und  united  internet  gruenden  european  net  id  foundation 

(last  accessed  on  10  January  2019). 


376  https://www.verimi.de/ ,  cf.  also  https://t3n.de/news/loqin-dienst-verimi-tvpisch-1 01 401 0/  (last  accessed  on  1 0 
January  2019). 
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tracking”  via  Facebook  Pixel.  Another  possible  submarket  could  be  defined  for  products 
that  offer  websites  and  apps  statistics  on  the  use  of  their  services  regardless  of  the 
advertisements  they  include.  The  latter  describes  the  activity  of  “Facebook  Analytics” 
and  “Google  Analytics”.  When  measuring  advertising  success,  each  affected  online 
advertising  market  could  also  be  taken  into  account  as  offers  are  often  bundled.  Again, 
the  exact  market  definition  can  be  left  open. 

2.  Market  dominance 

374  Facebook  is  the  dominant  company  in  the  national  market  for  social  networks  for 
private  users  pursuant  to  Section  18(1)  in  conjunction  with  (3)  and  (3a)  GWB  as,  based 
on  an  overall  assessment  of  all  factors  of  market  power,  the  company  has  a  scope  of 
action  in  this  market  that  is  not  sufficiently  controlled  by  competition. 

375  The  question  of  whether  and  to  what  extent  market  dominance  is  to  be  assumed  to 
exist  on  the  other  markets  affected  can  remain  open. 

a.  The  concept  of  market  dominance  in  the  case  of  markets  for  free  services 

376  In  the  case  of  services  provided  free  of  charge  which  constitute  markets  in  accordance 
with  Section  18(2a)  GWB  (as  applicable  for  most  sides  of  the  market  of  the  social 
networks  relevant  in  this  context),  it  is  still  decisive  for  determining  whether  market 
dominance  exists  pursuant  to  Section  18(1)  GWB  to  establish  whether  the  company 
has  a  scope  of  action  that  is  not  sufficiently  controlled  by  competition.  According  to  the 
case-law,  this  scope  exists  if  its  position  in  the  market  enables  the  company  to  prevent 
effective  competition  being  maintained  on  the  relevant  market  by  giving  it  the  power  to 
behave  to  an  appreciable  extent  independently  of  its  competitors,  customers  and, 
ultimately,  consumers.377 

377  It  cannot  be  argued  here  that  the  harm  caused  by  market  power  is,  in  economic  terms, 
primarily  due  to  the  scope  for  price  increases  it  creates,  and  that  this  scope  would  not 
play  any  role  in  the  case  of  markets  for  free  services.  The  scope  for  setting  prices  is 
not  the  only  relevant  factor  in  defining  market  power.  Apart  from  resulting  in  excessive 
prices,  unconstrained  scope  of  action  can  also  lead  to  diminished  product  volume  and 
quality,  less  variety  as  well  as  less  dynamic  innovation.378 

378  Moreover,  market  power  can  actually  create  scope  for  raising  the  prices  of  services 
previously  provided  free  of  charge,  an  opportunity  which  would  not  exist  in  competitive 


377  Established  case-law,  e.g.  Federal  Court  of  Justice,  judgment  of  12  December  1978,  “Erdgas  Schwaben“, 
WuW/E  1533,  1536;  ECJ,  judgment  14  February  1978,  “United  Brands",  case  27/76,  para.  65. 

378  Cf.  Bundeskartellamt,  Guidance  on  Substantive  Merger  Control,  p.  2. 
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markets.  In  economic  terms  the  price  of  zero  must  also  be  considered  to  be  a  price. 
Also,  price  competition  is  not  only  about  the  amount  of  a  monetary  payment  but  is  also 
complemented  by  the  conditions  the  other  side  of  the  market  takes  into  account  when 
choosing  a  service  and  assessing  the  price  charged.  This  is  reflected  by  the  legal 
concept  of  imposing  abusive  business  terms.  Even  a  low  price  or  a  price  of  zero  which, 
however,  involves  other  disadvantageous  business  terms,  can  have  indirect  effects  on 
price  competition  and  possible  differentiations  of  the  business  model.  As  market  power 
restricts  the  options  to  negotiate  such  business  terms  with  the  other  side  of  the  market, 
such  a  restriction  is  covered  by  the  concept  of  market  dominance  even  if  services  are 
provided  free  of  charge. 

379  In  particular  in  the  case  of  advertising-funded  internet  platforms,  where  direct  monetary 
payments  by  users  of  the  services  are  replaced  by  attention  marketing  and  the 
marketing  of  user  data  to  advertisers  in  the  form  of  targeted  advertising,  the  scope  for 
processing  user  data  which  users  cannot  avoid  because  of  the  services’  market  power, 
is  also  a  relevant  factor  in  defining  market  power.  This  applies  irrespective  of  the 
question  of  whether  the  user  data  themselves  are  to  be  considered  as  payment  for  a 
service379  or  as  a  contractual  condition  serving  to  maintain  a  price  of  zero.  Besides,  the 
extent  of  data  processing  can  also  be  seen  as  an  element  of  the  quality  of  the  service. 

380  The  commercial  use  of  the  personal  data  of  customers,  users  and  third  parties  is  a 
significant  factor  for  competition  on  all  sides  of  the  markets,  in  particular  in  digital 
markets.  Businesses  therefore  strive  to  gain  as  much  information  as  possible  about 
their  (potential)  customers  in  order  to  improve  their  products  on  the  respective  sides  of 
the  market,  offer  personalised  services  and  enable  targeted  advertising.  Digitalisation 
and  particularly  the  internet  have  made  it  possible  to  collect  and  analyse  particularly 
large  amounts  of  data  (“volume")  from  different  sources  and  formats  (variety)  as  fast 
as  possible  (velocity).380  Among  other  things,  this  enables  businesses  to  build  customer 
and  interest  profiles  which  are  highly  relevant  for  their  competitive  performance. 

381  Furthermore,  the  multi-sided  character  of  the  market,  resulting  from  funding  by 
advertising,  leads  to  different  interests  being  pursued  by  different  groups  of  demand- 
side  users.  The  advertisers  providing  funding  are  strongly  interested  in  very  detailed  or 
even  granular  data  sets  (as  well  as  in  gaining  the  attention  and  time  of  the  respective 
user).  The  incentive  to  make  as  much  use  as  possible  of  existing  scope  for  data 


379  See  Commission  proposal  for  a  directive  “on  certain  aspects  concerning  contracts  for  the  supply  of  digital 
content”  of  9  December  2015,  https ://ec.europa.eu/transparencv/readoc/rep/1  /2015/DE/I  -2015-634-DE-F1- 
1  .PDF  (last  accessed  on  10  January  2019). 

380  These  three  terms  are  predominantly  used  to  describe  the  characteristics  of  "big  data".  They  stem  from  a 
research  report  by  Doug  Laney,  analyst  at  Gartner  Consulting;  see  also  Monopolies  Commission,  Special 
Report  on  "Competition  Policy:  The  challenge  of  digital  markets",  2015,  p.  44  with  further  references. 
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processing  is  extremely  strong  as,  on  the  advertising  side,  the  market  success  of  a 
service  will  increase  with  the  processing  of  more,  and  more  detailed,  user  data.  Apart 
from  the  elimination  of  the  opposite  market  side’s  self-determination  and  possibilities 
for  negotiation,  the  exploitation  of  a  company’s  scope  for  data  processing  based  on 
market  power  also  threatens  to  result  in  a  transfer  of  market  power  from  one  market 
side  to  the  other. 

382  It  cannot  be  argued  that  market  power  will  not  significantly  increase  the  scope  for 
processing  data  and  that  this  scope  already  exists  without  market  power.  In  this  respect 
the  legislator  has  come  to  a  different  decision  and,  in  view  of  the  relevance  of  data  for 
competition  and  the  risks  posed  by  market  power,  stipulated  in  Section  18(3a)  GWB 
(new)  that  access  to  such  data  was  a  stand-alone  criterion  in  the  assessment  of  market 
power.  The  users’  willingness  to  share  their  personal  data  seems  to  be  stronger  than 
their  willingness  to  pay.  Personal  data  are  a  non-rivalling  good  which  cannot  be  used 
up.  There  is  no  limited  budget  which  would  determine  the  consumers’  willingness  to 
pay  and  force  them  to  economise.  For  this  reason  the  consumers’  sensitivity  with 
regard  to  sharing  their  data  is  perhaps  generally  weaker  than  their  price  sensitivity. 

383  However,  scope  for  data  processing  still  remains  a  relevant  problem  with  regard  to 
market  power.  This  is  due  to  the  fact  that  even  on  markets  where  consumers  are  less 
sensitive  to  price  differences  (e.g.  in  the  case  of  relatively  low-cost  fees  for  products 
such  as  telephone  charges),  there  is  still  scope  for  price  increases  based  on  market 
power.  Furthermore,  a  typical  area  where  companies  have  room  for  manoeuvre  in  their 
interaction  with  end  consumers  is  the  negotiation  of  contractual  and  general  terms  and 
conditions.  It  is  undisputed  that  market  power  expands  a  company’s  opportunities  to 
behave  independently  of  customers  and  end  consumers. 

384  The  primary  problem  is  that  when  consumers  share  their  personal  data,  they  are  hardly 
able  to  judge  which  and  how  much  data  are  being  collected  by  which  company,  to 
whom  their  data  will  be  transmitted  and  what  are  the  implications  of  giving  consent  to 
process  their  data.  This  could  partially  explain  the  privacy  paradox  which  describes  the 
phenomenon  that  users  attach  great  value  to  the  protection  of  their  privacy,  but 
generously  share  their  personal  data  when  using  internet  services.381 

385  This  lack  of  transparency  in  data  processing  is  considerably  exacerbated  by  market 
power.  Market  power  makes  it  possible  to  process  data  even  against  the  will  of  users, 
thus  clearly  increasing  the  extent  to  which  data  is  processed.  If,  on  account  of  the 


381  Cf.  e.g.  the  article  „Das  Privacy  Paradox:  Digitalisierung  versus  Privatsphare“  by  Institut  der  deutschen 
Wirtschaft,  Cologne  at  https://blog.iwmedien.de/das-privacy-paradox-digitalisierung-versus-privatsphaere/ 
(accessed  on  27July  2018);  Taddicken,  M.,  „Selbstoffenbarung  im  Social  Web“,  Publizistik  (2011)  Issue  No.  56, 
p.  281  ft. 
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market  dominance  of  the  company,  users  have  no  choice  but  to  consent  to  their  data 
being  processed,  the  investigations  have  shown  that  they  will  skip  reading  the  data 
processing  policy  since  they  have  to  give  their  consent  anyway.382  It  is  thus  impossible 
for  individual  users  to  identify  which  data  a  company  has  actually  collected  about  them 
and  to  understand  the  importance  of  the  personal  data  added  by  a  user  to  the  personal 
data  already  collected.  Due  to  market  power  users  cannot  avoid  the  processing  of  their 
data. 

b.  Overall  assessment  of  the  factors  of  market  power  pursuant  to  Section  18(3) 
and  (3a)  GWB 

386  Based  on  an  overall  assessment  of  the  factors  of  market  power  under  Section  18(3) 
and  (3a)  GWB,  Facebook,  as  the  dominant  company  in  the  market  for  social  networks, 
has  a  scope  for  action  and  data  processing  which  is  not  sufficiently  controlled  by 
competition. 

387  As  this  case  involves  a  multi-sided  market  and  a  network,  the  criteria  under  Section 
18(3a)  GWB  are  relevant  factors  apart  from  the  market  structure  and  the  current 
competitors.  These  are  factors  that  focus  on  the  special  characteristics  of  multi-sided 
markets  and  networks  as  well  as  on  the  role  played  by  the  digital  economy  that  must 
be  taken  account  of  in  the  context  of  the  assessment  of  market  power.  While  generally 
irrelevant  in  other  markets,  these  characteristics  constitute  additional  elements  of 
market  power  to  be  considered  when  assessing  market  power  pursuant  to  Section 
18(3)  GWB.  Flowever,  they  also  specify  the  factors  listed  in  Section  18(3)  GWB,  in 
particular  with  regard  to  market  entry  barriers.  The  factors  listed  also  describe  the  threat 
of  monopolisation  through  “tipping”  which  exists  in  multi-sided  markets  and  networks 
in  certain  cases.383  According  to  the  investigations  the  market  structure  (see  (1)  and 
the  other  factors  of  market  power  under  Section  18(3a)  and  (3)  GWB  (see  (2)  indicate 
that  the  market  for  social  networks  is  such  a  tipping  market  which  has  seen  Facebook 
emerging  as  a  monopolist  or  quasi-monopolist. 

(1)  Market  structure  and  competitors  of  social  networks 

388  According  to  the  Bundeskartellamt's  investigations  Facebook  has  a  user  share  of  more 
than  [...]  on  a  narrowly  defined  market  for  social  networks  including  Facebook.com, 
Jappy,  Stayfriends,  StudiVZ  and  WizeLife  as  well  as  formerly  Google+  (see  (a).  Even 
if  the  user  numbers  of  the  services  YouTube,  Twitter  and  Snapchat  (which  are  only  to 


382  J  ] 

383  Legislative  intent  on  the  9th  amendment  to  the  German  Competition  Act  (GWB),  Bundestag  printed  paper 
18/10207,  p.  50. 
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be  considered  as  competition  from  substitutes)  are  completely  included  in  the 
calculation  as  well  as  Instagram  which  belongs  to  the  Facebook  group,  this  will  not 
significantly  reduce  Facebook’s  user-based  market  share  (see  (b). 

(a)  Market  shares 

389  A  factor  indicating  that  Facebook  has  a  dominant  position  in  the  market  is  first  of  all  the 
company’s  high  level  of  user-based  market  shares  which,  based  on  the 
Bundeskartellamt’s  investigations  and  several  metrics  available,  amount  to  between  50 
and  almost  1 00%  (see  i.).  Apart  from  the  special  characteristics  of  the  market  for  social 
networks,  the  share  of  daily  active  users  of  social  networks  is  the  most  significant  metric 
in  the  assessment  of  the  market  position.  According  to  this  indicator,  Facebook 
achieved  a  user-based  market  share  of  more  than  [...]  in  2017  (see  ii.). 

i.  Determined  shares  of  users 

390  In  order  to  determine  the  structure  of  the  market  for  social  networks  for  private  users, 
which  is  characterised  by  mostly  free  services,  the  Bundeskartellamt  examined  several 
key  figures  on  which  an  initial  assessment  of  market  shares  can  be  based.  These  are 
in  particular  several  shares  of  users  which  can  be  expressed  on  the  basis  of  the 
numbers  of  daily  active  users  (DAUs),  monthly  active  users  (MAUs)  and  the  number  of 
registered  users  of  the  services. 

391  The  social  networks  Facebook.com,  (formerly)  Google+,  Stayfriends,  StudiVZ,  Jappy 
and  Wize.Life  were  asked  to  state  their  quarterly  user  numbers  achieved  during  the 
previous  years.  The  companies  surveyed  were  able  to  provide  such  data  for  the  period 
between  the  first  quarter  of  2014  (Q1,  2014)  and  the  first  quarter  of  2018  (Q1,  2018). 
According  to  these  figures  Facebook’s  user-based  market  share  in  Germany  amounts 
to  between  [...]  and  [...]  %  in  the  first  quarter  of  2018,  depending  on  the  factor 
measured.384 

392  Based  on  the  daily  active  users,  the  calculation  of  user  shares  provides  the  following 
result385: 


384  If  an  attempt  was  made  to  deduct  from  the  total  market  volume  any  users  who  potentially  use  more  than  one 
service,  Facebook's  user-based  market  share  might  even  be  higher. 

385  [  ] 
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Shares  of  users  based  on  daily  active  users  (DAUs) 

Facebook 

Google+ 

Stayfriends 

StudiVZ 

Jappy 

Wize. Life 

Q1 2012 

[>90%] 

[0-5%] 

[0-5%] 

no  information 
provided 

[0-5%] 

[0-5%] 

Q1 2013 

[>95%] 

[0-5%] 

[0-5%] 

no  information 
provided 

[0-5%] 

[0-5%] 

Q1 2014 

[>95%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q1 2015 

[>95%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q1 2016 

[>95%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q1 2017 

[>95%] 

[0-5%] 

[0-5%] 

no  information 
provided 

[0-5%] 

[0-5%] 

Q1 2018 

[>95%] 

[0-5%] 

[0-5%] 

no  information 
provided 

[0-5%] 

[0-5%] 

393  “Daily  active  users”  are  users  who  use  the  network  at  least  once  a  day.  With  an 
increasing  user-based  market  share,  Facebook’s  share  of  the  market  affected  comes 
close  to  a  monopolistic  position.  In  the  period  under  review  no  competitor  has  thus 
been  able  to  achieve  a  user-based  market  share  higher  than  5%. 

394  Looking  at  the  development  over  the  last  5  years  it  becomes  evident  that  Facebook’s 
user-based  market  share  has  continued  to  increase  in  the  period  under  review  at  the 
very  high  level  that  the  company  had  already  reached  in  2012.  In  contrast,  the  user- 
based  market  shares  of  Stayfriends  and  Jappy  have  been  constantly  decreasing.  As 
StudiVZ  has  become  insolvent,  current  user  figures  are  not  available.  It  can  be 
assumed,  however,  that  the  company’s  user  numbers  have  stagnated  at  the  level 
reached  in  2016  or  have  even  decreased  further.  Jappy’s  and  Wize. Life’s  user-based 
market  shares  are  hardly  perceptible  at  a  very  low  level  and  have  marginally  increased 
over  the  last  two  years.  Google+  had  temporarily  been  able  to  increase  its  user-based 
market  share,  albeit  at  a  very  low  level.  It  increased  slightly  during  the  period  between 
the  1st  quarter  of  2014  and  the  1st  quarter  of  2015.  In  the  following  quarters,  however, 
its  share  continuously  dropped  and  finally  reached  a  level  of  [...]. 

395  The  market  shares  based  on  the  number  of  monthly  active  users  (MAUs)  are  as 
follows:386 
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Shares  of  users  based  on  monthly  active  users  (MAU) 

Facebook 

Google+ 

Stayfriends 

StudiVZ 

Jappy 

Wize.Life 

Q1 2012 

[80-85%] 

[0-5%] 

[10-15%] 

no  information 
provided 

[0-5%] 

[0-5%] 

Q1 2013 

[80-85%] 

[5-10%] 

[5-10%] 

no  information 
provided 

[0-5%] 

[0-5%] 

Q1 2014 

[75-80%] 

[9-14%] 

[5-10%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q1 2015 

[73-78%] 

[15-20%] 

[l-6%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q1 2016 

[73-78%] 

[15-20%] 

[l-6%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q1 2017 

[79-88%] 

[10-15%] 

[0-5%] 

no  information 
provided 

[0-5%] 

[0-5%] 

Q1 2018 

[82-87%] 

[7-12%] 

[0-5%] 

no  information 
provided 

[0-5%] 

[0-5%] 

396  Monthly  active  users  are  defined  as  users  who  used  the  respective  service  at  least 
once  a  month  within  a  set  timeframe.387 

397  With  [. . .],  Facebook’s  user-based  market  shares  are  high  in  this  area  as  well.  They  are 
currently  on  the  rise  again  after  a  marginal  decrease  in  201 5  and  2016.  Google+,  which, 
until  the  autumn  of  2016,  showed  an  upward  trend  reaching  a  share  of  between  [...], 
still  had  a  market  share  of  merely  [. . .]  in  the  1  st  quarter  of  201 8. 

398  The  market  shares  based  on  the  number  of  registered  users  are  as  follows:388 


Market  shares  based  on  the  number  of  registered  users 

Facebook 

Google+ 

Stayfriends 

StudiVZ 

Jappy 

Wize.Life 

Q1  2012 

[60-65%] 

[5-10%] 

[13-18%] 

[13-18%] 

[0-5%] 

[0-5%] 

Q1  2013 

[52-57%] 

[20-25%] 

[11-16%] 

[9-14%] 

[0-5%] 

[0-5%] 

Q1  2014 

[46-51%] 

[31-36%] 

[9-14%] 

[7-12%] 

[0-5%] 

[0-5%] 

Q1  2015 

[45-50%] 

[35-40%] 

[8-13%] 

[5-10%] 

[0-5%] 

[0-5%] 

Q1  2016 

[45-50%] 

[40-45%] 

[7-12%] 

[5-10  %] 

[0-5%] 

[0-5%] 

Q1  2017 

[50-55%] 

[35-40%] 

[6-11%] 

no  information 
provided 

[0-5%] 

[0-5%] 

Q1  2018 

[52-57%] 

[36-41%] 

[6-11%] 

no  information 
provided 

[0-5%] 

[0-5%] 

399  Registered  users  are  users  who  have  registered  for  a  service  by  creating  an  account. 
Despite  an  increasing  user  base  in  absolute  numbers,  Facebook’s  user-based  shares 


387  [■■■] 
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dropped  from  an  overall  increasing  total  market  volume  of  more  than  [...]  in  the  1st 
quarter  of  2012  to  between  [...]  in  the  1st  quarter  of  2016,  but  rose  again  to  reach  a 
level  of  [...]  in  the  1st  quarter  of  2018.  On  this  basis,  Google+  reached  a  considerably 
higher  share  than  based  on  the  other  user-based  metrics,  as  does  Stayfriends.  The 
market  shares  of  these  competitors  have,  however,  been  decreasing  over  the  last  three 
years,  also  when  considering  the  number  of  their  registered  users. 

ii.  Daily  active  users  as  a  key  metric  in  the  assessment  of  market  power 

400  In  the  Bundeskartellamt’s  opinion,  and  contrary  to  the  view  held  by  Facebook389,  it  is 
primarily  Facebook’s  share  of  daily  active  users  of  social  networks  which  represents 
an  important  indicator  of  the  network’s  competitive  significance  and  market  success. 

401  From  the  Bundeskartellamt’s  point  of  view,  in  cases  involving  internet  services  and 
platforms,  market  shares  can  at  best  be  considered  as  an  indicator  for  the  presumption 
of  market  dominance.  In  general,  a  sufficiently  meaningful  indication  of  market  power 
cannot  solely  be  based  on  market  shares  as  it  is  always  required  to  carry  out  an  overall 
assessment  of  all  circumstances  of  a  case.  This  applies  all  the  more  to  internet 
platforms  and  networks  within  the  meaning  of  Section  18(3a)  GWB  where,  in  the 
assessment  of  market  shares,  account  must  be  taken  of  the  general  tendency  towards 
concentration  of  platform  markets  with  pronounced  indirect  network  effects  as  well  as 
networks  with  pronounced  direct  network  effects.390 

402  In  the  Bundeskartellamt's  view,  the  consideration  of  market  shares  is  nevertheless  an 
important  element  of  the  concept  for  examination  under  competition  law  as  it  enables 
the  authority  to  describe  the  market  structure  and  market  positions  of  the  competitors 
in  their  relationship  with  one  another.  For  the  assessment  of  the  market  position  of  a 
leading  company  in  a  specific  market,  its  relative  market  share,  i.e.  its  market  share 
lead  over  its  competitors,  has  always  been  a  more  relevant  indicator  than  any  absolute 
values.  Furthermore,  the  development  of  market  shares  as  a  dynamic  element  plays 
an  important  role  in  assessing  the  sustainability  of  a  company’s  market  position. 

403  This  generally  also  applies  to  internet  services  such  as  social  networks,  in  particular 
with  regard  to  the  threat  of  tipping,  i.e.  the  monopolisation  of  the  market  as  a 
consequence  of  self-reinforcing  network  effects  which,  if  specific  factors  are  present, 
can  result  in  a  gradual  exit  of  the  remaining  competitors  from  the  market  and  create  a 
significant  entry  barrier.  It  is  precisely  the  threat  of  tipping  which  is  covered  by  the 


389  [...] 

390  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks”,  June  2016,  p.  66ff. 
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particular  criteria  detailed  in  Section  18(3a)  GWB.391  Where  a  strong  market  share  lead 
over  competitors  which  are  potentially  already  gradually  leaving  the  market  is 
developing  over  a  long  period  of  time,  this  can  provide  a  first  indication  of  a  tipping 
process  or  a  competitive  advantage  that  competitors  cannot  catch  up  on.392 

404  With  regard  to  the  mechanisms  of  network  effects  that  depend  in  particular  on  the 
number  of  users,  the  intensity  of  use  and  also  the  identity  of  users,  the  number  of  users, 
as  a  kind  of  quantity-based  market  share,  plays  a  much  more  important  role  than  an 
assessment  in  terms  of  turnover  volume.  A  calculation  of  market  shares  based  on 
turnover  figures,  a  common  practice  in  many  cases,  will  reach  its  limits  in  an 
assessment  under  competition  law  of  online  platforms  like  Facebook,  because  one  or 
several  sides  of  the  platform  are  available  free  of  charge.  A  purely  value-based 
calculation  would  neglect  competition  from  free  or  ad-financed  services.  In  the  present 
case,  practically  all  competitors  included  in  the  assessment  (with  the  exception  of 
Stayfriends  which  was  only  included  as  a  precautionary  measure)  offer  their  services 
free  of  charge  to  private  users  of  social  networks  as  this  market  is  predominantly  based 
on  financing  through  advertising.  A  turnover-based  assessment  thus  cannot  be  carried 
out  on  the  users’  side  of  market,  but  only  on  the  advertising  side.  However,  as  the  user 
side  of  a  platform  must  be  considered  to  qualify  as  a  market  based  on  Section  18(2a) 
GWB,  market  dominance  cannot  only  be  established  on  the  basis  of  the  adverting  side. 
In  what  is  already  current  practice,  a  volume-based  assessment  of  market  shares  must 
in  any  case  be  carried  out  if  it  is  not  possible  to  determine  turnover-related  market 
shares.393 

405  Furthermore,  in  economic  terms,  the  “installed  base”  of  a  network  is  very  important, 
as  the  consequences  of  the  network  effect  or  the  value  of  the  network,  respectively, 
depend,  among  other  factors,  on  this  base.  Although  several  definitions  exist  in  the 
literature,  the  installed  base  generally  depends  on  the  number  of  users  of  a  service  or 
technology  and  their  opportunities  to  switch.394  In  determining  whether  a  tipping 
process  is  imminent,  the  Bundeskartellamt  considers  the  installed  base  of  a  network  to 
be  significant  for  the  assessment  of  the  competitive  lead  of  a  specific  company.  The 


391  Legislative  intent  on  the  9th  amendment  to  the  German  Competition  Act  (GWB),  Bundestag  printed  paper 
18/10207,  p.  50. 

392  Bundeskartellamt,  Working  paper  Market  Power  of  Platforms  and  Networks,  June  2016,  p.  68  for  indirect 
network  effects,  and  p.  101  for  direct  network  effects. 

393  Cf.  Bechtold,  GWB,  Section  18,  para.  34. 

394  Cf.  e.g.  Farrell/Saloner,  “Installed  Base  and  Compatibility:  Innovation,  Product  Preannouncements,  and 
Predation”,  The  American  Economic  Review,  1986,  Vol.  76(5),  p.  940-955,  who  define  the  previous  number  of 
users  using  the  old  technology  as  installed  base;  Malueg/Schwartz,  “Compatibility  Incentives  of  a  Large  Network 
Facing  Multiple  Rivals”,  Journal  of  Industrial  Economics,  2006,  54(4),  p.  527-567,  on  the  other  hand,  only 
consider  those  users  of  the  old  technology  as  installed  base  who,  due  to  contractual  obligations  cannot  switch 
to  the  new  technology  and  where  competition  can  thus  only  affect  new  customers;  Working  paper,  p.  93  ff. 
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value  of  the  network  often  only  shows  if  the  installed  base  is  sufficiently  large,  as  the 
network  effect  can  be  minimal  with  small  user  numbers  and  increases  disproportionally 
as  the  number  of  users  increases,  which  is  a  further  argument  in  favour  of  giving 
precedence  to  the  analysis  of  user  numbers. 

406  However,  contrary  to  Facebook’s  view,  the  number  of  monthly  active  users  cannot 
simply  be  used  as  a  so-called  “industrial  standard”.395  From  the  Bundeskartellamt’s 
point  of  view,  the  user-based  indicator  which  determines  the  “use”  of  a  service  in  an 
individual  case  must  be  determined  for  each  individual  market  and  on  the  basis  of  the 
specific  product  in  question.  The  fact  that  it  can  be  necessary  to  take  into  account 
different  indicators  depending  on  each  individual  case  scenario  is  reflected  in  the 
economic  literature  some  of  which  differentiates  between  whether  users  already  benefit 
from  (positive)  network  effects  if  members  of  the  other  user  group  are  present  on  the 
platform  (“membership  externalities”  or  “membership  values”)  or  whether  this  benefit 
only  becomes  effective  in  the  case  of  usage,  e.g.  when  a  certain  interaction  takes  place 
(“usage  externalities”  or  “interaction  values”).396 

407  In  the  case  of  social  networks  it  is  above  all  the  above-mentioned  purpose  of  finding 
persons  the  user  already  knows  and  connecting  with  them  as  well  as  the  daily 
exchange  of  experiences,  opinions  and  content  within  specifically  identified  groups  of 
contacts  defined  by  the  user  which  indicates  that  the  number  of  daily  active  users  is 
the  primary  indicator  of  the  value  of  a  network  and  its  market  success.  As  described, 
the  users’  requirements  are  determined  by  the  great  intensity  of  use  of  social  networks 
as  a  virtual  social  space.  Also  in  the  assessment  of  market  shares,  the  intensive  activity 
in  terms  of  time  spent  by  users  thus  also  provides  an  important  indication  of  the 
competitors’  actual  market  positions. 

408  For  the  assessment  of  the  direct  network  effects  present  in  this  case  (s.  para.  218 
above)  and  a  tipping  process,  and  with  regard  to  the  defined  requirements,  it  is 
extremely  important  for  a  social  network  whether  users  can  expect  to  be  sufficiently 
able  to  interact  with  their  friends.  Daily  use  can  thus  also  cover  a  qualitative  aspect  of 
the  network  effects.  This  is  also  reflected  by  the  result  of  the  user  survey  in  which  62% 
of  the  respondents  stated  that  the  regular  activity  of  the  other  users  was  at  least  an 
important  criterion  for  their  decision  to  use  a  network.397 


395  [  ] 

396  Cf.  e.g.  Weyl,  “A  Price  Theory  of  Multi-Sided  Platforms",  American  Economic  Review,  2010,  100(4),  p.  1642- 
1672;  Rochet/Tirole,  ‘‘Two-sided  markets:  a  progress  report",  RAND  Journal  of  Economics,  2006,  37(3),  p.  645- 
667. 

397  [..■] 
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409  In  comparison  with  the  daily  active  users  the  measurement  of  monthly  active  users  is 
less  significant  as  it  does  not  reflect  the  typical  requirements  of  the  users  and  their 
typical  behaviour.  Many  operators  of  social  networks  which  participated  in  the  survey 
stated  that  they  also  measure  their  market  success  on  the  basis  of  “daily  active  users” 
398  and  consider  a  great  frequency  of  usage  (“user  engagement”,  “virality”,  “activity  on 
the  platform”)  to  be  the  key  element  in  the  success  of  a  social  network.399  The  monthly 
active  users  metric  thus  cannot  be  referred  to  as  an  “industrial  standard”.  Facebook 
itself  also  regularly  states  the  number  of  its  daily  active  users  (DAUs)  in  its  annual 
reports  and  considers  this  metric  to  be  the  relevant  basis  for  measuring  intensity  of  use, 
whereas  the  number  of  monthly  active  users  is  seen  as  the  basis  for  measuring  the 
global  active  user  community.400 

410  The  success  of  the  business  model,  which  is  financed  by  highly  individual  targeted 
advertising,  is  due  above  all  to  the  strong  daily  user  engagement,  the  user  data  this 
involves  and  the  possibility  this  creates  for  exposing  users  to  advertisements  over  a 
long  period.  The  service’s  options  for  monetisation  are  thus  also  indicated  by  daily  user 
engagement. 

41 1  The  calculation  of  user-based  shares  on  the  basis  of  registered  users  is,  however,  not 
a  significant  metric  that  could  indicate  the  actual  market  success  of  a  social  network.401 
Although  mandatory  registration  is  a  typical  feature  of  social  networks,  there  are 
misjudgements  regarding  the  overall  number  of  users  (more  than  [...]  in  Germany)  as 
well  as  the  individual  user  shares  under  several  aspects.  It  is  not  evident  whether 
registration  is  always  followed  by  use  of  the  social  network.  An  explicit  termination 
resulting  in  the  deletion  of  the  registration  or  the  user  account  is  not  possible  at  all  in 
some  cases,  or  at  least  this  functionality  is  difficult  to  find.  From  the  users’  perspective, 
simply  not  using  an  account  could  be  seen  as  an  alternative  to  termination  as  the  use 
of  social  networks  is  free  of  charge  on  the  market  concerned,  which  is  why  users  have 
no  monetary  incentive  to  explicitly  terminate  an  account  if  they  do  not  use  the  network. 

412  Moreover,  the  increasing  share  of  users  registered  with  Google+  would  have  been 
highly  overestimated.  This  share  resulted  in  particular  from  the  connection  of  Google+ 
with  other  Google  services.  From  2013  to  2015  users  had  to  have  a  Google-i-  account 
in  order  to  be  able  to  register  for  YouT ube.  At  least  until  September  201 4,  users  wishing 


398  [  j 

399  [  ] 

400  Facebook  Inc.,  Annual  Report  2017,  p.  33/  34:  “We  view  DAUs,  and  DAUs  as  a  percentage  of  MAUs,  as 
measures  of  user  engagement";  "MAUs  are  a  measure  of  the  size  of  our  global  active  user  community." 
(available  for  download  at 

https://s21.q4cdn.com/399680738/files/doc  financials/annual  reports/FB  AR  2017  FINAL.pdf),  [...] 


401  [■■■] 


116 


to  set  up  a  GMail  account  had  to  set  up  a  Google+  account  as  well.402  And  at  least  for 
a  short  while,  Google+  was  pre-installed  on  many  Android  devices.403  While  Google 
had  terminated  this  compulsory  connection  between  different  Google  services  in 
response  to  continuous  criticism,  it  is  doubtful  whether  this  has  led  any  significant 
numbers  of,  e.g.,  YouTube  users  to  delete  their  Google+  account. 

413  The  Bundeskartellamt  therefore  bases  its  assessment  of  market  power  on  a  user- 
based  market  share  of  Facebook  that  has  continuously  exceeded  90%  since  201 2,  with 
an  upward  trend. 

(b)  Substitute  competition  by  YouTube,  Twitter  and  Snapchat  does  not  significantly 
relativise  Facebook’s  market  share 

414  The  company’s  market  share  of  more  than  [...]  is  not  significantly  relativised  by 
substitute  competition  from  other  social  media,  in  particular  YouTube,  Twitter  and 
Snapchat.  This  would  even  apply  if  these  services  were  included  in  the  market  as 
genuine  competitors,  as  called  for  by  Facebook.404 

415  In  the  Bundeskartellamt’s  view,  substitute  competition  between  other  social  media  and 
social  networks  is  not  strong  enough  to  actually  justify  a  representation  of  market 
shares  in  the  market  for  social  networks. 

416  As  illustrated  by  the  market  definition,  other  social  media  do  not  serve  the  same 
purpose  as  social  networks.  The  fact  that  these  media  also  pursue  the  purposes  of 
communication  and  online  information  exchange  in  the  broadest  sense  does  not  mean 
that  the  differences  can  be  seen  as  a  wide  variety  of  product  differentiations  -,  e.g. 
similar  to  a  geographic  chain  of  substitution  405  or  as  “closest  competitors”.  When  it 
comes  to  options  for  substitution  these  exist  exclusively  for  one  party  in  terms  of 
product  overlaps  in  some  features. 

417  Twitter  and  Snapchat,  in  particular,  can  be  replaced  by  the  relevant  functionalities  of 
Facebook.com,  including  the  Facebook  Messenger,  in  many  aspects.  On  the  other 
hand,  however,  Twitter  and  Snapchat  can  (and  are  intended  to)  replace  the 
functionalities  of  Facebook.com  only  in  limited  partial  areas  and  cannot  offer  a  full  social 
user  experience.  Only  Facebook.com  offers  all  functionalities  that  are  necessary  to 
represent  a  virtual  social  space.  As  a  consequence,  there  is  in  fact  a  competitive 

402  http://www.cnet.de/88137220/amail-konto-setzt-keine-aooale-anmelduna-mehr- 

voraus/?inf  bv=5a002dd5671db8487b8b4b3a  (last  accessed  on  10  January2019). 

403  https://www.smartdroid.de/android-weniaer-apps-muessen-vorinstalliert-sein-aoogle-faellt-wea/  (in  German, 
last  accessed  on  1 0  January  201 9). 

404  [  j 

405  Commission  Notice  on  the  definition  of  relevant  market  for  the  purposes  of  Community  competition  law,  OJ  of 
9  December1997,  C  372/5,  para.  57f. 
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relationship  between  Facebook.com  and  the  other  services.  Fiowever,  this  relationship 
does  not  exist  on  the  market  for  social  networks,  but  on  the  markets  for  the  other 
services  that  must  be  defined  separately.  Although  Facebook.com  also  enables  video 
upload  there  is  not  much  overlap  with  YouTube  with  regard  to  the  video  platform 
function,  because  on  Facebook  video  uploads  are  only  a  tool  for  social  user  experience 
within  a  circle  of  friends. 

418  Ultimately,  however,  the  market  is  highly  concentrated  to  the  benefit  of  Facebook,  even 
if  the  daily  active  users  of  YouTube,  Snapchat  and  Twitter,  in  particular,  are  to  be 
included  in  the  market,  as  claimed  by  Facebook.  If  YouTube,  Twitter  and  Snapchat  are 
to  be  included  in  the  relevant  market  according  to  the  degree  of  overlaps  in  some  of 
the  features,  it  is  not  justified  to  consider  WhatsApp  and  Instagram,  important  services 
which  are  parts  of  the  Facebook  group,  as  belonging  to  different  markets.  Facebook’s 
reasoning  that  Snapchat  and  Instagram  belong  to  the  market  affected,  but  not 
WhatsApp406,  cannot  be  followed.  If  Snapchat,  whose  services  focus  on  photos  as  well 
as  messaging,  is  included  in  the  market,  so  must  WhatsApp  as  the  widest-reaching 
messaging  service  whose  functionalities  overlap  with  services  such  as  Snapchat  in 
many  aspects. 

With  regard  to  this  competitive  environment,  the  shares  of  daily  active  users  in  the  1st 
quarter  of  2018  are  as  follows:407 


Service 

DAUs  1st  quarter  2018 

WhatsApp 

[40-50%] 

Facebook 

[20-30%] 

YouTube408 

[10-20%] 

Instagram 

[10-20%] 

Snapchat 

[0-10%] 

Twitter 

[0-10%] 

Google+ 

[0-5%] 

Stayfriends 

[0-5%] 

StudiVZ 

[0-5%] 

Jappy 

[0-5%] 

Wize.Life 

[0-5%] 

406  [  ] 

407  [...] 

408  [  ] 
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419  The  above  figures  illustrate  that  with  the  WhatsApp,  Facebook.com  and  Instagram 
services,  the  Facebook  group  has  a  registered  daily  user  share  of  more  than  [...],  and 
thus  a  significant  market  share  lead  over  its  next  largest  competitors  YouTube  and 
Snapchat.  Even  if  the  monthly  active  users  were  considered,  the  result  would  not  be 
significantly  different. 

420  Even  if  WhatsApp  were  to  be  excluded  from  the  market,  as  called  for  by  Facebook409, 
Facebook  would  still  achieve  a  very  high  share  of  daily  active  users  with  its  services 
Facebook.com  and  Instagram. 


Service 

DAUs  1st  quarter  2018 

Facebook 

[30-40%] 

YouTube410 

[20-30%] 

Instagram 

[20-30%] 

Snapchat 

[8-13%] 

Twitter 

[0-5%] 

Google+ 

[0-5%] 

StudiVZ 

[0-5%] 

Stayfriends 

[0-5%] 

Jappy 

[0-5%] 

Wizelife 

[0-5%] 

421  Even  if  analysed  on  this  basis,  Facebook,  together  with  Instagram,  would  still  achieve 
a  market  share  of  [. . .]  with  a  significant  market  share  lead  over  YouT ube  and  Snapchat. 

(2)  Criteria  defining  market  power  pursuant  to  Section  18(3)  and  (3a)  GWB 

422  Based  on  the  criteria  defining  market  power  pursuant  to  Section  18(3)  and  (3a)  GWB, 
the  high  user-based  market  share  of  more  than  [...]  is  a  manifestation  of  market  power. 
Due  to  the  network  effects  (see  (a)  and  the  lock-in  effect  caused  by  a  high  degree  of 
incompatibility  and  the  lack  of  multi-homing  by  Facebook  users  within  the  market  (see 
(b),  the  development  of  the  market  conditions  on  the  narrow  market  for  social  networks 
suggests  that  monopolisation  due  to  market  tipping  can  reasonably  be  assumed  to 


409  [  ] 

4,0  [■■■] 
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exist.  Economies  of  scale  (c)  as  well  as  the  company’s  superior  access  to  competition¬ 
relevant  data  (see  d)  and  the  limited  extent  of  innovation-driven  competitive  pressure 
(e)  are  further  elements  of  Facebook’s  dominant  position  in  the  market. 

(a)  Network  effects  (Section  18(3a)  no.1  GWB) 

423  In  view  of  the  significant  market  share  lead  over  its  competitors,  market  dominance  is 
indicated  in  particular  by  the  identity-based  positive  direct  network  effects  emerging 
among  the  private  users  of  the  social  network  of  Facebook.com.  A  significant 
concentration  process  has  been  developing  in  the  market  for  social  networks  which 
can  be  attributed  to  the  self-reinforcing  feedback  loop  that  can  be  regularly  observed 
in  positive  direct  network  effects.  The  indirect  network  effects  occurring  at  the  same 
time  due  to  the  multi-sided  character  of  the  market  lead  to  a  further  consolidation  of 
this  trend. 

i.  Direct  network  effects  and  self-reinforcing  feedback  loops 

424  With  a  product  such  as  social  networks,  competition  is  threatened  by  the  so-called 
market  tipping  effect  which  is  based  on  the  self-reinforcing  feedback  loops  of  direct 
network  effects.  Market  tipping  means  that  if  the  market-specific  size  of  a  network  is 
exceeded  due  to  the  self-reinforcing  feedback  loop  for  this  network,  almost  no 
customers  will  be  left  for  competing  networks,  and  users  who  previously  used  other 
networks  will  switch  to  the  larger  one.  During  this  process,  most  of  the  current 
competitors  will  lose  out  as  their  shrinking  networks  are  becoming  unattractive  (“winner 
takes  most”  or  “winner  takes  all”)411,  which  will  result  in  a  monopoly  or  quasi-monopoly 
situation.  Until  the  market  tips,  the  competitive  relationship  between  the  providers  of 
networks  will  be  characterised  by  a  competition  for  the  market. 

425  This  process  starts  because  in  direct  network  effects,  as  described  above  in  para. 
21 4ff.,  the  benefit  or  profit  of  users  depends  on  the  overall  number  of  network  users.  A 
differentiation  must  be  made  as  to  whether  users  benefit  from  a  large  number  of  co¬ 
users  (positive  direct  network  effects)  or  from  the  fact  that  the  number  of  co-users  is 
less  significant  (negative  direct  network  effects).  The  self-reinforcing  feedback  effect  is 
only  inherent  in  positive  direct  network  effects  where  the  growth  in  user  numbers  gives 
other  users  the  incentive  to  use  the  network.  Due  to  the  benefit  provided  by  network 
effects  users  tend  to  prefer  large  networks  and,  in  the  long  term,  can  gather  in  a  single 
large  network.412  In  choosing  a  network  new  users  will  tend  to  opt  for  the  network  which 


411  Dewenter/Rosch,  Einfuhrung  in  die  neue  Okonomie  der  Medienmarkte,  2015,  p.  197  ff.  refers  to  a  trend  towards 
a  “natural  monopoly”  (“naturliches  Monopol”). 

412  Cf.  Bundeskartellamt,  Working  paper  “Market  Power  of  Platforms  and  Networks”,  June  2016,  p.  100 
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most  of  their  friends  are  using  (identity  of  users)  or  which  they  expect  to  be  used  by 
most  of  their  friends  (size  of  the  network).  The  larger  a  network,  the  more  attractive  it 
will  be  for  new  users. 

426  Direct  network  effects  and  their  self-reinforcing  feedback  loop  thus  represent  a 
significant  market  entry  barrier.  It  is  of  key  importance  for  new  suppliers  entering  the 
market  to  quickly  reach  a  critical  mass  which  will  enable  them  to  benefit  from  direct 
network  effects  that  create  or  increase  their  networks’  benefit.413  A  supplier  must 
convince  users  that  the  new  network  will  have  a  permanent,  high  market  presence.  The 
new  supplier  cannot  present  an  existing,  sufficiently  large  network  in  which  users  can 
find  their  communication  partners.  Suppliers  thus  depend  on  the  subjective 
expectations  of  users.414 

427  The  user  behaviour  described  is  confirmed  in  the  present  case  by  the  user  survey 
carried  out  by  the  Bundeskartellamt:  Users  of  social  media  were  asked  how  important 
several  specified  reasons  had  been  for  their  choice  of  a  social  network.  86%  of  the 
users  said  it  was  important  or  very  important  for  them  that  friends,  family  members  and 
colleagues  used  the  network.  The  overall  number  of  persons  using  the  network  was 
referred  to  by  47%  of  the  users  as  an  important  or  very  important  reason  for  their  choice 
of  a  social  network,  whereas  62%  of  the  users  said  it  was  important  or  very  important 
to  them  that  persons  in  their  geographic  vicinity  (e.g.  city  or  district)  use  the  network.415 
62%  of  the  respondents  considered  the  activity  of  users  to  be  important  or  very 
important  for  their  choice  of  a  network. 

428  The  self-reinforcing  feedback  effect  is  clearly  reflected  by  the  development  of  the  user 
numbers  of  Facebook.com  based  on  daily  active  users  as  well  as  monthly  active  users. 
Although  there  has  not  been  any  established  method  so  far  for  calculating  the  self¬ 
reinforcing  feedback  process  of  direct  network  effects,  the  development  of  user 
numbers  as  from  a  network’s  market  entry  can  be  used  as  an  approximation.  The 
“installed  base”  is  a  key  indicator  for  the  significance  of  the  network  effect  in  a  market.416 

429  The  user  numbers  of  Facebook.com  have  continuously  increased  since  the  network’s 
market  entry  in  Germany  in  2008:417 


4,3  See  also  European  Commission,  "Microsoft/Linkedln",  decision  of  6  December  2016,  Comp/M.  8124,  para.  346. 

414  Cf.  e.g.  Sailer,  Regulierungsbedarf  in  Netzwerken?  Implikationen  fur  die  Internetokonomie,  Die  Weltwirtschaft 
2001,  352  f.;  also  Farrell/Saloner,  “Standardization,  Compatibility,  and  Innovation",  The  RAND  Journal  of 
Economics,  1 985, 1 6(1 ),  p.  70-83;  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks", 
June  2016,  p.  92. 

415  [■■■] 

416  Cf.  Bundeskartellamt,  'Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016,  p.  93f. ;  see  also 
e.g.  Farrel/Saloner,  "Installed  Base  and  Compatibility:  Innovation,  Product  Preannouncements,  and  Predation", 
The  American  Economic  Review,  1986,  Vol.  76(5),  p.  940-955. 

417 
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Quarter 

DAUs  (in  thousands) 

MAUs  (in  thousands) 

Q1  2009 

[...] 

[...] 

Q1  2010 

[...] 

[...] 

Q1  2011 

[...] 

[...] 

Q1  2012 

[...] 

[...] 

Q1  2013 

[...] 

[...] 

Q1  2014 

[...] 

[...] 

Q1  2015 

[...] 

[...] 

Q1  2016 

[...] 

[...] 

Q2  2016 

[...] 

[...] 

Q3  2016 

[...] 

[...] 

Q4  2016 

[...] 

[...] 

Q1  2017 

[...] 

[...] 

Q2  2017 

[...] 

[...] 

Q3  2017 

[...] 

[...] 

Q4  2017 

[...] 

[...] 

Q1  2018 

[...] 

[...] 

430  In  the  first  year,  Facebook.com  already  had  more  than  [...]  daily  active  users.  Within 
one  year  the  installed  base  increased  to  more  than  [...]  daily  active  users,  and  to  more 
than  [...]  daily  active  users  by  2011.  In  the  following  years  the  numbers  of  daily  active 
users  as  well  as  monthly  active  users  continued  to  increase.  In  the  1  st  quarter  of  201 7, 
the  user  base  of  Facebook.com  rose  to  23  million  daily  active  users.418  Although  there 
was  a  slight  decline  in  the  number  of  daily  active  users  in  the  1st  quarter  of  2018,  this 
does  not  reflect  a  trend  for  the  year  201 7.  The  user  numbers  have  continued  to  increase 
over  the  entire  year.  The  number  of  monthly  active  users  has  also  remained  at  a  high 
level. 

431  With  regard  to  the  significance  of  intensity  of  use  for  network  effects,  it  is  useful  to  look 
at  the  development  of  the  number  of  monthly  active  users  in  comparison  to  the  daily 
active  users.  Even  if,  as  called  for  by  Facebook419,  the  services  mentioned  above  were 
included  in  the  market  as  genuine  competitors,  this  would  not  much  affect  the 
significance  of  the  trend  towards  concentration  in  the  market  for  social  networks.  It  can 


4,8  See  the  figures  published  by  Facebook  (in  German)  on  1  June  2017  at 
https://de.newsroom.fb.com/news/2017/06/eine-communitv-von-30-millionen-facebook-saqt-danke/,  [...] 

419  [■■■] 
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be  observed  that,  after  strong  growth  during  the  first  few  years,  Facebook.com 
continued  to  win  over  [...]  monthly  active  users  per  year  in  the  following  years.  Over 
time  these  users  have  been  using  the  network  more  and  more  actively,  as  is  illustrated 
by  the  fact  that,  in  relative  terms,  the  number  of  daily  active  users  has  increased  more 
significantly  than  the  number  of  monthly  active  users.  The  share  of  daily  active  users 
in  the  number  of  monthly  active  users  has  increased  from  initially  approx.  [. . .]  to  approx. 
[. . .].  Only  in  the  1  st  quarter  of  201 8  did  the  intensity  of  use  slightly  decrease. 

ii.  Likelihood  of  market  tipping  process 

432  The  fact  that  competitors  can  be  seen  to  exit  the  market  and  that  there  is  a  downward 
trend  in  the  user-based  market  shares  of  the  remaining  competitors  strongly  indicate  a 
market  tipping  process  likely  to  result  in  Facebook.com  becoming  a  monopolist. 

433  Initially,  according  to  press  reports,  Facebook.com  had  made  a  poor  start  in  2008  and 
clearly  lagged  behind  the  market  leaders  in  Germany,  StudiVZ  and  SchulerVZ  as  well 
as  the  MySpace  music  network.  Despite  its  technical  superiority,  doubts  were 
expressed  publicly  about  whether  Facebook.com  would  be  able  to  succeed  in  the 
competition  against  the  network  effects  of  the  incumbents.420 

434  At  least  from  2011,  however,  the  user-based  market  shares  of  the  competitors 
operating  in  Germany  strongly  decreased.  According  to  the  Bundeskartellamt’s 
investigations,  StudiVZ  activities  declined  at  the  end  of  2010,  a  trend  that  rapidly 
accelerated  in  201  1.421  In  2011,  Facebook.com  overtook  StudiVZ  in  terms  of  user 
numbers.  SchulerVZ  discontinued  its  operations  on  30  April  2013.  In  the  autumn  of 
2012,  StudiVZ  was  sold  to  a  financial  investor  and  its  user  numbers  continued  to 
decline.422  On  7  September  2017  its  owner,  Poolworks,  filed  for  insolvency.423  It  is 
unclear  whether  the  network’s  operations  can  continue. 

435  A  similar  development  could  be  observed  in  the  cases  of  Lokalisten,  Stayfriends  and 
MySpace.424  Despite  significant  investments  by  the  then  owner  of  Lokalisten, 
ProSiebenSat.  1 ,  the  intensity  of  use  also  declined  by  the  turn  of  the  year  2009/201 0.425 


420  FAZ.NET  of  27  April  2008  http://bloas.faz.net/netzwirtschaft-bloq/2008/04/27/facebook-verpatzt-den- 
deutschland-start-249(in  German,  accessed  on  10  January  2019). 

421  [■■■] 

422  [  ] 

423  Cf.  http://www.spieqel.de/wirtschaft/unternehmen/studivz-ist-pleite-a-1 166735.html  (in  German,  last  accessed 
on  10  January  2019). 

424  Cf.  articles  by  the  German  magazine  Focus  of  2013  http://www.focus.de/digital/mvspace-studivz-lokalisten- 
lokalisten-langsamer-aber-sicherer-niederaang  id  3474203.html  (last  accessed  on  10  January  2019);  and  by 
the  German  daily  Suddeutsche  Zeitung  of  6  March  2012. 

https://web.archive.Org/web/20120306030551/http://newsticker.sueddeutsche.de/list/id/1273471  (last 

accessed  on  1 0  January  201 9). 

425  [■■■] 
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User  numbers  were  in  decline  as  from  201 1  and  could  not  be  stabilised  by  attempts  to 
diversify  through  the  introduction  of  gaming  or  dating  features.426  The  Lokalisten 
network  discontinued  its  operations  on  30  September  201 6. 427  The  reasons  given  for 
this  included  Facebook’s  market  position  in  the  market  for  social  networks  which  was 
described  as  a  “winner  takes  all”  market.428  The  Jappy  social  network  also  initially 
reported  a  considerable  decline  in  user  activity429  between  2011  and  the  summer  of 
2012,  followed  by  a  continuous  decline  in  user  numbers.  Stayfriends  was  able  to 
increase  its  user  numbers  up  until  201 1  when,  according  to  Stayfriends,  [...].  After  this, 
user  numbers  have  plunged  [...].430  Facebook. corn’s  user  numbers  continue  to  rise. 

436  These  developments  reflect  the  competitive  effect  of  direct  network  effects  and  the 
market  tipping  process:  Initially  there  was  intensive  competition  for  the  market  resulting 
in  the  creation  of  a  powerful  network  or  a  monopolist.  The  decrease  in  user  numbers 
experienced  by  all  competitors  from  2011  onwards  gives  reason  to  suggest  that  a 
market  tipping  process  had  already  started  at  that  time  which  caused  the  then  market 
leader  StudiVZ  as  well  as  Lokalisten  to  exit  the  market  or  to  be  likely  to  exit  the  market. 

437  Competition  for  the  market  also  included  the  market  entry  of  Google+  in  2011.  In 
Germany,  Google+  was  also  able  to  attract  a  significant  number  of  daily  active  users. 
However,  its  user  numbers  remained  at  a  relatively  low  level431  and  have  meanwhile 
been  declining.  Its  limited  initial  success  can  be  explained  by  the  subjective 
expectations  users  have  about  the  potential  market  presence  of  the  Google  service. 
Such  expectations  play  a  decisive  role  in  the  market  entry  of  network  products,  as 
described  above.432  Until  its  market  exit,  however,  there  had  been  no  direct 
monetisation  of  the  private  service  through  advertising.  Also,  in  order  to  differentiate  its 
social  network  from  Facebook.com,  Google+  repositioned  the  network  and  put  more 
emphasis  on  the  common  interests  of  users  and  the  possibility  to  find  people  to  connect 
with.  With  the  launch  of  the  corporate  version  of  Google+  in  spring  2018  and  the 
shutdown  of  the  consumer  version,  the  business  model  was  changed  into  a  free-of- 


426  [■■■] 

427  Cf.  heise-online,  “Lokalisten  und  die  Crux  mit  dem  Netzwerkeffekt“  of  30  September  2016, 
https://www.heise.de/newsticker/meldunq/Lokalisten-und-die-Crux-mit-dem-Netzwerkeffekt-3338475.htmKin 

German,  last  accessed  on  10  January  2019);  [...] 

428  [  ] 

429  [...]  https://www.qruenderszene.de/interviews/iappy-matthias-voql  (in  German,  last  accessed  on  10  January 
2019). 

430  [■■■] 

431  [■■■] 

432  Cf.  e.g.  Sailer,  Regulierungsbedarf  in  Netzwerken?  Implikationen  fur  die  Internetokonomie,  Die  Weltwirtschaft 
2001,  352f.;  also  Farrell/Saloner,  “Standardization,  Compatibility,  and  Innovation",  The  RAND  Journal  of 
Economics,  1 985, 1 6(1 ),  p.  70-83;  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks", 
June  2016,  p.  92. 
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charge  service  for  internal  corporate  communications.  The  exit  of  Google+  from  the 
market  gives  rise  to  the  assumption  of  an  unrestricted  trend  towards  monopolisation. 

438  From  the  Bundeskartellamt’s  point  of  view,  the  market  success  of  YouTube  and 
Snapchat  cannot  be  used  as  an  argument  against  the  market’s  trend  towards  tipping. 
As  discussed,  these  services  are  not  part  of  the  market.  If  they  were  to  be  included  in 
the  market,  this  would  not  make  much  difference  to  the  high  market  shares  and 
Facebook. corn’s  lead.  YouTube  is  a  product  which  differs  from  Facebook.com  in  many 
aspects  and,  if  it  were  included  in  the  product  market,  it  would  not  be  a  close  competitor 
in  terms  of  private  users,  but  rather  a  competitor  on  the  online  advertising  market,  as 
was  ultimately  confirmed  by  Facebook’s  statements  regarding  the  “competition  for  the 
users’  time”. 

439  Even  if  these  services  can  be  seen  as  product  differentiations  in  comparison  to 
Facebook.com,  it  seems  likely  that  the  different  user  preferences  have  resulted  in  a 
splitting  of  the  market  resulting  in  monopolisation  trends  emerging  in  the  individual  sub- 
markets.  This  has  also  been  shown  e.g.  in  the  Microsoft/Linkedln  merger  control 
proceeding  in  which  the  Commission  considered  professional  social  networks  to  be  an 
independent  product  market  where  the  threat  of  market  tipping  was  assumed  to  exist 
in  several  geographic  markets  where  competitors  were  still  active  (Austria,  Germany 
and  Poland)  because  of  an  expansion  of  Linkedln’s  user  base.  The  concentration  was 
only  cleared  subject  to  conditions.433  The  Bundeskartellamt’s  investigations  in  the 
present  case  have  also  shown  that  Linkedln’s  user  base  has  continually  grown  since 
2008. 

440  Similar  developments  are  likely  to  take  place  in  the  case  of  video  sharing  platforms  with 
user-generated  content,  such  as  YouTube,  in  the  German  market.  According  to  public 
statistics,  YouTube  had  a  user  share434  of  more  than  80%  in  the  sector  of  video 
platforms  in  Germany  in  2016.  The  next  closest  competitors,  according  to  this  statistic, 
were  DailyMotion  and  Clipfish,  each  with  less  than  5%. 435  The  video  platform  MyVideo, 
which  had  been  YouTube’s  most  significant  competitor  in  Germany  for  a  long  stretch 
of  time,  was  given  up  by  its  operator  ProSiebenSat.1  Media  SE  in  September  2017  and 
had  already  ceased  to  be  relevant  in  the  2016  statistics.  The  platform  Clipfish  which 
belongs  to  the  RTL  group  was  transformed  into  the  platform  “Watchbox”  which  no 
longer  allows  user-generated  content. 


433  European  Commission,  “Microsoft/Linkedln”,  decision  of  6  December  2016,  Comp/M.  8124,  para.  339ff. 

434  On  the  basis  of  the  "monthly  unique  visitor",  a  metric  essentially  comparable  to  the  “monthly  active  user“. 

435  Cf.  https://de.statista.com/statistik/daten/studie/209329/umfraae/fuehrende-videoportale-in-deutschland-nach- 

nutzeranteil/  (in  German,  last  accessed  on  10  January  2019). 
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iii.  Indirect  network  effects  raising  market  entry  barriers 

441  In  the  assessment  of  market  dominance,  account  must  also  be  taken  of  indirect  network 
effects  many  of  which  are  created  by  the  fact  that  Facebook  is  characterised  as  a  multi¬ 
sided  market.  The  indirect  network  effects  that  are  combined  with  the  direct  network 
effects  increase  the  market  entry  barriers  for  social  networks  even  further  and  thus 
strengthen  the  trend  towards  tipping. 

442  Indirect  network  effects  occur  in  advertising-financed  services  which  can  also  be 
referred  to  as  “audience  providing  platforms”  (see  para.  221  above)  because  the  benefit 
the  advertising  side  derives  from  the  platform  depends  on  the  number  and  composition 
of  the  service’s  users.  Positive  indirect  network  effects  for  advertisers  are  generated  as 
they  will  profit  from  large  numbers  of  users  and  different  target  groups  using  a  service. 
The  indirect  network  effects  of  audience  providing  platforms  are  often  asymmetric  as 
enhanced  advertising  is  not  necessarily  an  advantage  from  the  users’  perspective. 

443  For  an  advertising-financed  platform  product,  sustainable  market  entry  is  already  more 
difficult  right  from  the  start  as  suppliers  must  be  successful  in  entering  at  least  two  sides 
of  the  market,436  in  this  case  the  user  market  for  social  networks  and  the  online 
advertising  market.  In  the  present  case,  Facebook. corn’s  high  user-based  market  share 
indicates  that  advertising-financed  business  models  are  successful  in  the  market.  A 
payment-based  business  model  going  beyond  freemium  models  will  have  difficulties 
entering  the  market  as  users  are  unwilling  to  pay  for  the  service.437  In  view  of  the 
indirect  network  effects,  a  critical  mass  of  users  representing  an  attractive  target  group 
for  advertisers  must  be  achieved  in  order  to  be  able  to  monetise  a  product  through 
advertising.  However,  due  to  direct  network  effects,  such  a  critical  mass  is  difficult  to 
achieve. 

444  Sustainable  market  entry  is  therefore  considerably  more  difficult  even  with  a  non- 
monetised,  free  product  that  is  usually  required  to  achieve  a  critical  mass  online.  There 
are  also  very  little  chances  for  achieving  monetisation  independently,  i.e.  not  through 
the  takeover  of  the  free  service  by  a  company  active  in  the  market.  Only  Google-i-  was 
able  to  enter  the  market  with  a  network  that  was  not  directly  monetised  and  to  stay  in 
the  market  over  a  considerable  stretch  of  time  with  more  than  only  marginal  user 
numbers.  This  was  possible  because  the  service  could  be  integrated  into  the  broad 
advertising-financed  portfolio  with  a  strong  market  presence  and  because  the  overall 


436  Cf.  Caillaud/Jullien,  "Chicken  &  Egg:  competition  among  intermediation  service  providers",  RAND  Journal  of 
Economics,  2003,  34(2),  p.  309ff. 
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portfolio  could  benefit  from  the  service  in  terms  of  data  processing  by  combining 
Google+  data  with  those  collected  by  the  group’s  other  services,  e.g.  YouTube. 

445  The  “Vero”  product  whose  market  entry  is  pointed  out  by  Facebook438,  confirms  this 
monetisation  problem  in  the  market  for  social  networks.  “Vero”  is  a  mobile  app  which 
describes  itself  as  a  “true  social  network”  and  which,  according  to  public  reports,  has 
been  available  in  app  stores  free  of  charge  since  2015.  It  is  owned  by  Vero  Labs,  Inc. 
whose  CEO  is  the  Filipino  billionaire  Ayman  Hariri.  In  early  2018  the  app  suddenly 
became  popular  as  one  of  the  top  downloads  of  Apple  App  Store.  This  is  mainly 
attributed  to  Vero’s  advertising  claim  that  it  will  always  be  free  of  advertising,  not  collect 
any  data  and  not  use  any  sorting  algorithms.  Vero  promised  the  first  million  users 
lifetime  free  accounts.  After  reaching  the  one  million  user  mark  the  service  was  to  be 
transferred  into  a  paid-for  business  model  the  costs  of  which  are  unclear.  Also,  turnover 
was  to  be  achieved  through  commissions  on  the  sale  of  products.  The  service  has 
meanwhile  reached  the  one  million  user  mark.  The  free-of-charge  offer  has  been 
extended  indefinitely.  After  two  months  the  rush  to  sign  up  with  Vero  was  over.439 

446  What  has  been  shown  by  Vero  is  that  it  is  relatively  easy  at  first  to  win  over  users  within 
a  relatively  short  period  of  time  for  a  completely  free  online  product  without  any 
monetisation.  This  is  a  very  typical  form  of  market  entry  in  the  internet,  which,  however, 
in  contrast  to  Facebook’s  claim440,  does  not  give  any  indication  as  to  its  sustainability. 
The  service  must  prove  itself  when  it  comes  to  its  first  monetisation,  which  has  not  even 
been  attempted  yet  by  Vero,  particularly  if  it  is  to  develop  into  a  paid-for  business 
model. 

447  In  the  present  case,  however,  the  indirect  network  effects  are  not  suitable  to  put  into 
perspective  the  high  market  shares  on  the  user  side  in  view  of  the  market  structure  and 
competition  on  what  potentially  has  to  be  defined  as  a  larger  online  advertising  market. 
It  has  to  be  generally  assumed  that,  due  to  the  indirect  network  effects,  suppliers  of 
advertising-financed  products  will  take  the  effects  on  each  sides  of  the  market  into 
account  in  their  strategic  decisions.  If  users  leave  the  platform  because  of 
disadvantageous  strategic  decisions  made  by  the  supplier  on  the  user  side,  this  can 
have  direct  negative  effects  on  the  advertising  side  as  advertisers  consider  the  wide 
reach  of  platforms  such  as  Facebook.com  to  be  a  great  advantage.441  In  the  present 
case,  however,  it  cannot  be  concluded  from  this  that  Facebook's  scope  of  action  on  the 
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[...] 

Cf.  https://www.qiqa.de/extra/social-media/specials/was-ist-vero-die-social-app-erklaert/  (available  in  German 
only,  last  accessed  on  10  January  2019). 
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user  side  is  sufficiently  controlled  by  indirect  network  effects  affecting  the  advertisers’ 
side  of  the  market  or  by  competitive  pressure  on  the  advertisers’  side.  Contrary  to 
Facebook’s  view442,  a  detailed  investigation  and  consideration  of  the  competitive 
activity  on  the  advertisers’  side  is  not  required  as  this  cannot  be  assumed  to  have 
positive  effects  on  the  services’  side  even  if  a  competitive  market  were  assumed  to 
exist. 

448  The  possibility  of  users  leaving  the  network  is  considerably  restricted  due  to  the 
combination  of  indirect  and  direct  network  effects.  Users  switching  to  another  network 
would  lose  their  contacts  as  it  is  unlikely  that  their  friends  and  other  contacts  will  switch 
as  well  (see  para.  460  ff.  below  for  details  on  obstacles  preventing  consumers  from 
switching  due  to  the  lock-in-effect).  In  view  of  the  role  played  by  the  social  network  as 
the  online  reflection  of  their  social  environment  and  activities,  users  often  cannot  even 
refrain  from  using  the  network  as  this  would  isolate  them  from  their  contacts  and  the 
exchange  of  information.443 

449  Furthermore,  as  discussed  above,  competition  on  the  advertisers’  side  precisely 
creates  a  strong  incentive  to  use  the  scope  for  data  processing  as  the  market  success 
of  a  service  will  increase  on  the  advertisers’  side  if  more  and  more  detailed  user  data 
can  be  processed.  It  is  generally  difficult  for  users  to  track  how  their  data  are  being 
processed  which  makes  it  unlikely  that  a  significant  number  of  users  will  leave  the 
network,  irrespective  of  the  direct  network  effects.  A  restriction  of  the  scope  for 
processing  data  by  a  competitive  advertisers’  side  can  therefore  not  be  assumed.  Due 
to  the  fact  that  the  markets  are  connected,  indirect  network  effects  threaten  to  result  in 
the  transfer  of  market  power  towards  the  online  advertising  market. 

450  This  has  also  been  confirmed  by  the  investigations  which  have  shown  that  Facebook’s 
overall  advertising  revenue  massively  increased.  According  to  statistics  published  by 
Facebook444,  its  (worldwide)  turnovers  doubled  in  2017  and  2018  (approx.  100  %  rate 
of  increase  over  two  years). 


442  J  j 

443  According  to  a  2016  study  by  the  California  State  University,  the  use  of  Facebook  and  other  social  networks  can 
even  lead  to  addiction,  cf.  http://www.independent.co.uk/news/science/facebook-could-affect-brain-in-similar- 
wav-to-cocaine-studv-finds-a6877236.html  (last  accessed  on  1 0  January  201 9). 

444  Cf.  Facebook,  presentation  Q4  Results,  slide  4,  available  at 
https://s21  .g4cdn.com/399680738/files/doc  financials/201 8/Q4/Q4-201 8-Earnings-Presentation.pdf,  [...] 
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451  Based  on  a  national  online  advertising  market  for  social  media,  for  which  the 
investigations  have  produced  some  indications,  Facebook  has  meanwhile  become  the 
market  leader  in  terms  of  turnover.445 

(b)  Parallel  use  of  services  and  high  barriers  for  switching,  Section  1 8(3a)  no.  2  GWB 

452  The  assumption  of  market  dominance  and  a  monopolisation  trend  on  the  user  market 
for  social  networks  resulting  from  direct  network  effects  is  supported  by  a  clear  lack  of 
parallel  use  of  services  (multi-homing)  on  the  market  concerned.  Moreover,  due  to  the 
identity-based  direct  network  effects  and  the  high  degree  of  incompatibility  with  other 
services,  the  significant  lock-in  effect  creates  high  barriers  for  users  wishing  to  switch, 
and  thus  ties  users  to  Facebook,  which  also  supports  the  assumption  of  a  market 
tipping  process. 

i.  Multi-homing 

453  There  is  no  significant  parallel  use  of  social  networks  in  the  market  which  could  prevent 
the  elimination  of  competitors  and  facilitate  new  market  entries. 

454  In  general,  multi-homing  can  counteract  the  imminent  tipping  of  a  market  which  is  likely 
to  occur  due  to  direct  network  effects.  If  users  extensively  use  several  networks,  this 
can  prevent  the  elimination  of  competitors  from  the  market  even  if  the  market  shows  a 
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trend  towards  concentration.  This  can  also  lower  the  high  barrier  to  market  entry  as 
extensive  multi-homing  helps  new  entrants  to  win  over  customers  even  if  these  are 
already  using  a  large  network.446 

455  According  to  the  economic  literature,  multi-homing  is  closely  connected  to  product 
differentiation  caused  by  heterogeneous  user  preferences.  In  the  case  of  multi-sided 
markets,  multi-homing  can  result  from  a  horizontal  platform  differentiation  in  which 
platforms  differentiate  themselves  from  their  competitors  by  targeting  specific  user 
groups.  A  horizontal  platform  differentiation,  according  to  the  literature,  could  thus 
result  in  the  emergence  of  several  specialised  platforms  offering  special  features.  This 
can  lead  to  multi-homing  on  one  or  both  sides  of  the  platforms,  e.g.  because  users  on 
one  side  of  the  platform  would  like  to  address  different  user  groups  on  the  other  side. 
Multi-homing  will  then  tend  to  have  a  deconcentration  effect,  in  particular  in 
combination  with  platform  differentiation.447  This  concept  is  generally  also  used  for 
(incompatible)  networks.448 

456  An  intensive  product  differentiation  in  social  networks  resulting  in  multi-homing  and 
deconcentration  is  not  evident.  In  particular,  it  cannot  be  decisive  whether 
Facebook.com  users  also  use  other  social  media  that  do  not  belong  to  the  market  for 
social  networks.  According  to  the  Bundeskartellamt’s  investigations,  users  often  use 
several  social  media  in  parallel.  [...],  Twitter  users  e.g.  often  also  use  Facebook.com, 
Instagram,  WhatsApp  and  Snapchat.449  Flowever,  as  described  above,  these  services 
are  used  to  fulfil  different  requirements  and  therefore  belong  to  different  markets. 

457  If  there  is  a  large  number  of  differentiated  social  media  which  offer  products  that  are 
more  or  less  different  from  one  another,  it  must  first  of  all  be  investigated  in  accordance 
with  the  demand-side  substitutability  concept  whether  the  differentiated  social  media 
are  functional  substitutes  and  thus  fulfil  the  same  requirements.  If  these  differentiated 
products  are  predominantly  used  in  parallel  to  complement  each  other  and  if  they  are 
not  substitutable  for  one  another,  they  belong  to  separate  markets.  From  the 
Bundeskartellamt’s  point  of  view,  the  concept  of  multi-homing  as  relevant  under 
competition  law  only  applies  if  networks  are  used  in  parallel  on  the  same  market.  Only 
in  this  way  it  can  be  determined  whether  the  relevant  market’s  trend  towards  tipping 


446  B6-57/15,  OCPE  M/EliteMedianet,  decision  of  22  October  2015,  para.  151  [...] 

447  Cf.  above  all  Evans/Schmalensee,  “The  Industrial  Organisation  of  Markets  with  Two-Sided  Platforms", 
Competition  Policy  International,  2007,  Vol.  3,  No.  1 ,  p.  1 51  -1 79;  Katz,  “Competition  policy  in  network  industries", 
Keynote  Lecture,  Annual  Conference  of  the  German  association  of  economists  Verein  fur  Socialpolitik,  2013. 

448  Katz/Shapiro,  “Systems  Competition  and  Network  Effects",  Journal  of  Economic  Perspectives,  1994,  8(2),  p. 
93-115;  Doganoglu/Wright,  “Multihoming  and  compatibility",  International  Journal  of  Industrial  Organization, 
2006,  24,  p.  45-67;  cf.  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016, 
p.  95. 
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can  be  slowed  down  and  whether  the  high  entry  barriers  to  this  specific  market  can  be 
lowered.  The  parallel  use  of  a  product  that  fulfils  different  requirement  is  of  no 
competitive  relevance  for  the  respective  markets,  apart  from  limited  fringe  competition 
due  to  the  users’  limited  time  and  monetary  budget.450 

458  The  parallel  use  of  Facebook.com  and  YouTube  or  other  social  media  is  thus  not 
directly  relevant  for  Facebook’s  market  position  and  the  monopoly  position.  All  in  all, 
due  to  the  direct  network  effects,  a  product  differentiation  in  the  case  of  networks  can 
precisely  lead  to  the  splitting  of  the  market  as  described  above.  Monopolisation  trends 
will  again  occur  in  such  cases  on  the  individual  submarkets.451 

459  Multi-homing  by  Facebook  users  with  (formerly)  Google-i-  and  Jappy  and  possibly  with 
the  differentiated  networks  Stayfriends  and  Wize.Life  would  be  required  for  a  relevant 
effect  on  Facebook’s  market  position.  Such  a  parallel  user  behaviour  is  not  at  all  evident 
in  view  of  the  quasi-monopoly  Facebook  has  established  with  more  than  90  percent  of 
the  user-based  market  shares.  Effective  multi-homing  in  the  market  would  have  to  be 
reflected  by  lower  market  share  leads.  Where  90  percent  of  the  users  use  a  specific 
service  without  any  significant  overlaps,  this  can  only  be  qualified  as  single-homing  and 
indicates  a  market  tipping  process  that  has  in  fact  not  been  prevented  by  multi-homing. 

ii.  Lock-in  effect  creates  high  barriers  for  switching 

460  The  high  barriers  for  users  wishing  to  switch  which  can  be  observed  in  the  market  for 
social  networks  also  support  the  assumption  of  market  dominance  and  a  market  tipping 
process.  The  identity-based  network  effects,  in  particular,  lead  to  a  lock-in  effect  which 
makes  it  difficult  for  users  or  prevents  them  from  switching  to  another  social  network. 
The  incompatibility  between  Facebook.com  and  other  social  networks,  i.e.  the 
technological  basis  of  the  network  effect,  is  not  reduced  by  the  existing  features  and 
interfaces  to  other  services. 

•  Lock-in  through  incompatibility  and  identity-based  network  effects 

461  The  high  barrier  for  users  wishing  to  switch  is  created  by  the  identity-based  direct 
network  effects  that  cannot  exist  across  all  networks  due  to  the  (technological) 
incompatibility  of  the  social  networks  in  the  market.  Compatibility  would  neutralise  the 
importance  of  network  effects  in  competition.452  Products  are  compatible  if  they  are 


450  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016,  p.  62  and  p.  101. 

451  On  the  market  for  online  dating  platforms,  high  platform  differentiation  resulted  in  intensive  multi-homing  as, 
according  to  the  investigations,  all  the  platforms  fulfilled  the  same  requirements  from  the  point  of  view  of  users 
and  were  thus  substitutable  for  each  other. 

452  Katz  &  Shapiro,  “Network  Externalities,  Competition,  and  Compatibility",  American  Economic  Review,  1 985,  Vol. 
75(3),  p.  424-440. 
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designed  in  such  a  way  that  they  can  cooperate  or  interact  with  each  other453  and  if 
they  are  thus  substitutable  with  regard  to  their  function.454  In  most  cases  this  is  not 
applicable  to  social  networks  as  all  their  features  are  customised  for  one  specific 
network  which  therefore  represents  a  “universe”  of  its  own.  In  this  respect  and  in  terms 
of  economics,  social  networks  are  comparable  to  systems  of  goods  or  services  which 
represent  a  bundle  of  mutually  compatible,  complementary  goods  or  services,  that  are 
used  in  the  same  context  and  are  jointly  considered  by  consumers  making  a  choice.455 
It  is  possible  that,  based  on  interfaces,  individual  functions  can  achieve  a  certain  degree 
of  compatibility.  However,  elements  of  the  system  of  network  cannot  be  substituted  by 
elements  of  the  other  system  or  network.456 

462  Users  wishing  to  switch  to  such  an  incompatible  network  face  several  different  barriers. 
Based  on  the  purpose  of  using  social  networks,  users  will  only  find  it  useful  to  switch 
to  an  alternative  network  if  they  can  meet  their  friends  and  acquaintances  there  as  well. 
Users  wishing  to  switch  would  therefore  have  to  convince  their  contacts  in  the  original 
network  to  switch  to  another  network  as  well.  As  these  contacts  also  have  further 
contacts  in  the  previous  network,  these  would  also  have  to  be  persuaded  to  switch. 
The  more  contacts  a  user  has  in  the  previous  network,  and  the  more  closely  these 
contacts  are  connected  with  other  users,  the  more  difficult  or  even  impossible  will  it  be 
to  transfer  these  contacts  to  a  new  network.  Users  wishing  to  switch  will  be  faced  with 
the  question  of  whether  they  should  still  switch  to  another  network  if  a  significant  share 
of  their  previous  contacts  will  not  do  the  same.  The  incentive  to  switch  to  another  social 
network  therefore  decreases  with  higher  intensity  of  use  of  the  previous  network. 

463  It  has  to  be  taken  into  account  that  the  use  of  social  networks  can  involve  much  more 
connections  than  e.g.  the  use  of  communication  and  messaging  services. 
Communication  services  enable  direct  communication  between  two  users  who  know 
each  other  or  within  a  specific  group  of  users.  If  users  of  messaging  services  only 
communicate  with  a  small  circle  of  friends,  their  address  books  stored  in  their  devices 
can  be  uploaded  and  the  group  can  thus  switch  to  a  competing  company.457  Social 
networks  enable  not  only  direct  communication  between  two  users,  but  also  indirect 
interaction  where  a  user  can  participate,  and  benefit  from,  the  communication  between 
other  users.  Sharing  or  passing  on  posts  in  social  networks  thus  also  enables  a  tiered, 

453  Farrell/Saloner,  Competition,  Compatibility  and  Standards:  The  Economics  of  Horses,  Penguins  and  Lemmings, 
1987,  p.  1 ;  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks”,  June  2016,  p.  92. 

454  Cf.  Pfeiffer,  Kompatibilitat  und  Markt,  1989,  p.  23. 

455  Cf.  Stelzer,  Digitale  Guter  und  ihre  Bedeutung  in  der  Internet-Okonomie,  p.  8  f,  https://www.tu- 
ilmenau.de/fileadmin/public/iwm/diggut.pdf  (last  accessed  on  26  October  2018). 

456  Cf.  Economides,  Networks  and  compatibility:  Implications  for  antitrust,  European  Economic  Review  1994,  655; 
id.,  Desirability  of  compatibility  in  absence  of  network  externalities,  The  American  Economic  Review,  1 165ff. 
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indirect  interaction  which  in  many  cases  is  also  intended.  In  this  way  connections  are 
established  between  users  who  do  not  know  each  other.458  If  users  switch  to  another 
social  network,  these  connections  will  also  be  lost  if  their  friends  cannot  be  persuaded 
to  switch  as  well. 

464  In  the  case  of  a  supplier  with  a  dominant  installed  base,  such  as  Facebook’s,  attempting 
to  transfer  contacts  to  a  new  network  and  refraining  from  using  the  network  will  both 
cause  high  switching  costs  (so-called  opportunity  costs),  which  leads  to  users  being 
less  willing  to  switch.  Where  the  installed  base  of  the  original  network  is  very  large, 
switching  to  another  network  will  only  be  attractive  for  users  if  the  benefit  created  by 
the  new  network  clearly  outweighs  the  switching  costs.  The  larger  the  installed  base  of 
the  original  network,  the  higher  the  benefit  of  the  new  network  will  have  to  be.459 

465  This  cannot  be  called  into  question  by  Facebook’s  claim  that  switching  suppliers  was  a 
gradual  process  which  in  most  cases  did  not  involve  any  “clear  break”  where  users 
“moved  out”  of  one  network  and  “moved  into”  another  network  (Bundeskartellamt 
unofficial  translation).460  This  does  not  change  the  fact  that  switching  will  only  create  a 
benefit  if,  at  the  end  of  this  process,  all  connections  will  actually  switch  to  another 
supplier.  In  this  respect,  the  gradual  process  means  that  switching  typically  involves  a 
temporary  process  of  multi-homing.  Such  multi-homing,  however,  is  not  evident 
because,  as  described  above,  practically  all  the  competitors’  user  numbers  are  in 
decline,  which  is  why  the  figures  cannot  be  interpreted  as  showing  a  switching  process. 
As  explained  above,  multi-homing  with  products  belonging  to  other  markets  cannot  be 
taken  into  account  in  this  respect  either. 

466  Contrary  to  the  view  held  by  Facebook461,  the  “Vero”  product  mentioned  above  is  not 
an  example  that  would  be  able  to  disprove  the  problem  of  direct  network  effects  and 
the  high  barrier  to  switching  created  by  these  effects.  On  the  contrary,  this  is  a  good 
example  for  proving  the  very  existence  of  the  problem.  Facebook’s  statement  that 
network  effects  can  easily  be  overcome  by  simple  information  and  calls  for  a  switch  or 
additional  use  of  the  previously  used  networks,  does  not  hold.  Facebook  refers  to  a 
tweet  on  Twitter  in  which  a  user  states  he  would  no  longer  be  using  Instagram  if  Vero 
were  to  remain  in  the  market.462  It  is  extremely  doubtful  whether  this  can  be  a  real 
option  for  convincing  one’s  friends  to  switch  to  another  network,  particularly  since  the 
networks  referred  to  provide  different  services.  Moreover,  Vero,  and  in  particular  its 
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Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016,  p.  100  f. 
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CEO  Hariri,  have  come  under  criticism  due  to  accusations  of  corruption,  exploitation 
and  abuse  of  power  in  connection  with  business  operations  in  Saudi  Arabia,  which  has 
resulted  in  negative  reactions  by  Twitter  users:  Tweets  marked  #deletevero  became  a 
trend  on  Twitter.463  This  does  not  appear  to  be  suitable  for  reducing  the  barriers  for 
switching. 

467  The  finding  that  there  are  high  barriers  to  market  entry  is  also  supported  by  the 
Bundeskartellamt’s  investigations  and  user  survey:  According  to  the  investigations,  a 
Facebook  user  has  an  average  of  [...]  friends464,  each  of  whom  also  has  an  average  of 
[...]  friends,  etc.  In  individual  cases  the  number  of  friends  on  Facebook.com  is  much 
higher  and  could  include  several  thousand  contacts  that  are  more  or  less  important. 
Even  if  not  all  of  these  [...]  friends  are  equally  important  for  the  user,  the  number  of 
users  that  would  have  to  be  persuaded  to  switch  in  order  to  achieve  a  similarly  high 
level  of  benefit  is  extremely  high. 

468  The  fact  that  users  of  social  networks  are  reluctant  to  switch  supplier  is  also  reflected 
in  the  responses  received  from  the  Facebook  users  who  participated  in  the  user  survey. 
Asked  to  indicate  reasons  in  favour  of  making  more  use  of  a  different  service,  76%  of 
the  Facebook  users  surveyed  stated  they  would  consider  this  if  friends,  family  members 
and  acquaintances  used  a  different  service.  Only  a  (in  some  cases  very  clear)  minority 
of  users  surveyed  indicated  they  would  consider  any  of  the  other  reasons  for  switching 
listed  by  the  survey.  Only  23%  thought  a  higher  activity  level  in  another  service  was  a 
reason  for  switching,  and  only  34%  referred  to  better  functionalities  as  a  possible 
reason.  This  shows  that,  if  their  contacts  do  not  switch  as  well,  most  of  the  Facebook 
users  surveyed  consider  the  costs  of  switching  to  another  service  to  be  too  high  to 
make  this  worthwhile,  even  if  the  new  service  is  a  more  active  or  better  one.  These 
figures  illustrate  that,  unless  they  succeed  to  attract  the  users’  friends  as  well,  it  will  be 
difficult  for  alternative  services  to  entice  users  away  from  Facebook.com  by  offering 
better  features  or  less  advertisements.  . 

•  No  data  portability 

469  Switching  is  also  made  difficult  because  of  the  lack  of  data  portability.  Switching  from 
one  network  to  another,  incompatible  network  not  only  requires  users  to  leave  behind 
or  transfer  friends  and  connections;  they  must  also  set  up  the  new  service,  a  profile 
and,  in  particular,  the  information  stored  in  the  previous  network.  Depending  on  the 
focus  of  their  activities,  users  actively  published  their  own  content  and  consumed, 
shared  or  commented  on  content  from  other  users.  Over  time  their  user  activities  will 

463  Cf.  https://www.horizont.net/tech/nachrichten/DeleteVero-Warum-der-Social-Media-Hype-schnell-wieder- 

vorbei-sein-koennte-1 65249  (available  in  German  only,  last  accessed  on  10  January  2019). 
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thus  result  in  the  creation  of  small  or  large  data  sets.  The  amount  of  time  involved  in 
building  up  a  new  identity  in  a  different  network  can  deter  users  from  using  a  different 
network.465 

470  There  are  only  limited  possibilities  to  port  the  profile  and  information  related  thereto  to 
other  networks.  While  it  is  possible  to  attribute  lists  of  friends  and  published  contents 
to  the  users,  it  is  more  complicated  to  attribute  to  users  their  reactions  to  the  activities 
of  other  users,  e.g.  by  sharing  or  commenting  on  their  contents,  or  conversely, 
responses  of  others  to  the  contents  shared  by  a  particular  user.  In  this  case  the  activity 
of  users  cannot  in  any  meaningful  way  be  separated  from  the  content  on  which  these 
activities  were  based  or  which  refer  to  these  activities.  Extracting  the  activities  of  the 
users  is  therefore  hardly  reconcilable  with  the  underlying  idea  of  a  social  network  which 
precisely  enables  interaction  between  its  users.  It  is  because  of  the  fundamental 
structure  of  a  social  network  that  the  transfer  of  one’s  own  activities  from  one  social 
network  to  another  is  only  possible  to  a  limited  extent. 

471  Facebook.com  offers  an  export  function  in  its  social  network  which  enables  users  to 
export  their  own  activities  in  a  file  (“download  your  information”  function).  If  users 
request  a  download,  Facebook.com  will  send  them  an  e-mail  with  a  file  which  includes 
the  user-related  content  in  a  browser-compatible  list.466  Flowever,  only  the  users’  own 
content,  as  published  by  the  users  themselves,  can  be  exported.  Reactive  activities  of 
a  user  cannot  be  exported,  i.e.  in  particular  likes  or  comments  on  content  published  by 
third  parties  as  well  as  reactions  by  third  parties  on  contributions  published  by  the 
respective  user.  The  export  function  offered  by  Facebook.com  is  thus  not  a 
comprehensive  feature. 

472  An  export  or  transfer  of  activities  that  refer  to  other  users  is  in  fact  hardly  conceivable. 
A  pure  export  of  the  content  a  user  created  in  reaction  to  e.g.  posts  by  other  users, 
would,  on  its  own,  be  taken  out  of  context.  An  alternative  would  be  to  export  the  entire 
context  in  which  the  user  was  active  as  well  to  ensure  that  the  user’s  activity  is 
embedded  within  its  context.  In  particular  in  the  case  of  very  active  users,  however,  this 
would  pose  not  only  technical  challenges.  Also  from  the  perspective  of  data  protection 
law  it  is  doubtful  whether  users  can  be  allowed  at  all  to  transfer  third-party  content  their 
own  activities  refer  to  within  the  context  of  an  export.  Furthermore,  the  data  that  can  be 
extracted  by  means  of  Facebook. corn’s  export  function  practically  cannot  be  used  as 


465  E.g.  for  professional  social  networks,  European  Commission,  “Microsoft/Linkedln“,  decision  of  6  December 
2016,  Comp/M.  8124,  para.  345. 
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there  is  no  possibility  to  import  them  into  other  networks.  The  exported  data  can  thus 
rather  be  used  for  archiving  purposes  instead  of  offering  portability. 

•  No  relevant  reduction  of  lock-in  effects  through  share  feature  in  other 
networks 

473  The  connection  between  Facebook.com  and  other  networks  or  other  social  media 
made  possible  by  the  share  feature  (share  button)  also  does  not  put  the  significance  of 
the  network  effects  into  perspective  or  reduce  in  any  relevant  way  the  lock-in  effects. 

474  Via  the  joint  interface  defined  by  Facebook  users  can  post  content  from  other  services 
such  a  Twitter,  Pinterest  or  WhatsApp  on  Facebook.com  by  using  a  sharing 
functionality.  Where  services  have  implemented  this  feature  it  can  be  easily  and 
comfortably  used.  Sharing  content  from  Facebook.com  with  other  services,  for  example 
on  iPhones467,  is,  however,  only  possible  via  an  additional  tool,  the  AddToAny  share 
plugin.  This  plugin  must  be  actively  installed  by  the  user;  it  is  not  an  integrated  feature 
in  Facebook. corn’s  share  button.  If  users  click  on  Facebook. corn’s  share  button,  a 
menu  will  appear  with  options  for  sharing  only  with  Facebook.com  itself  or  the 
Facebook  Messenger.  For  other  services,  including  WhatsApp,  users  must  copy  a  link 
and  insert  this  in  the  other  service. 

475  Moreover,  the  share  feature  requires  the  parallel  use  of  services  in  which  posts  are  to 
be  made.  This  also  applies  to  Facebook’s  login  feature  which  allows  users  to  register 
in  other  services  with  their  Facebook  profiles.  As  described  above,  such  multi-homing 
does  not  take  place  with  Facebook’s  competitors  to  any  relevant  extent  in  the  market 
for  social  networks. 

476  The  implementation  of  the  share  button  and  the  Facebook  login  involves  a  considerable 
amount  of  data  being  shared  with  Facebook.com.  This  means  that  e.g.  data  on  the 
user  behaviour  on  the  implementing  website  will  also  be  shared  with  Facebook.com. 
The  data  shared  strengthens  Facebook’s  data  base.  Also,  Facebook  receives 
information  on  its  competitors’  user  base  which  can  be  used  in  product  competition  to 
the  benefit  of  Facebook. 

(c)  Economies  of  scale  arising  in  connection  with  network  effects,  Section  18(3a) 
no.  3  GWB 

477  The  supply-side  economies  of  scale  enjoyed  by  Facebook  combined  with  the  direct 
network  effects  and  lock-in  effects  support  the  assumption  of  market  dominance  and 
also  indicate  a  market  tipping  process. 


467  No  such  tool  is  available  for  Android  systems. 
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478  Supply-side  economies  of  scale  are  particularly  significant  in  the  internet  economy 
because  the  development  costs  of  digital  goods  are  in  general  considerably  higher  than 
their  variable  running  costs.  The  higher  the  fixed  costs,  the  more  the  costs  per  user  will 
decrease  with  increasing  user  numbers.  In  particular  in  combination  with  network 
effects,  its  lower  average  costs  per  user  result  in  Facebook  gaining  a  significantly  larger 
strategic  scope  for  action  than  its  competitors,  and  this  scope  continues  to  increase. 

479  The  lock-in  effect  described  above  aggravates  this  development  and  leads  to  cost 
disadvantages  for  the  competitors.  Due  to  the  high  switching  costs  the  competitors’ 
prices  not  only  have  to  be  at  least  as  favourable  as  Facebook’s,  but  also  have  to 
compensate  for  the  switching  costs  if  users  are  to  be  motivated  to  switch.  This  cost 
effect  also  provides  Facebook  with  more  scope  of  action  vis-a-vis  its  competitors.  And 
finally  those  economies  of  scale  must  be  considered  which  result  from  the  joint 
monetisation  of  Facebook’s  services,  in  particular  Facebook.com  and  Instagram,  within 
the  context  of  Facebook’s  advertising  network. 

480  The  joint  effect  of  network  effects,  lock-in  effects  and  economies  of  scale  ultimately 
leads  to  a  situation  where  the  leading  competitor  becomes  increasingly  stronger  and 
its  competitors  become  more  and  more  insignificant.468  This  corresponds  to  the 
development  of  the  relevant  user-based  market  shares  in  the  market  for  social 
networks  described  above  and  indicates  a  market  tipping  process. 

(d)  Access  to  competition-related  data,  Section  18(3a)  no.  4  GWB 

481  Facebook  has  superior  access  to  data  relevant  for  competition,  in  particular  the 
personal  data  of  its  users.  In  view  of  its  superior  installed  base,  Facebook  has  a  very 
large  data  base.  The  data’s  level  of  detail  is  very  high  as  well  because  Facebook  has 
access  to  a  large  number  of  different  data  sources.  The  superior  access  to  user  data 
creates  an  additional  barrier  to  market  entry  which,  in  connection  with  the  direct  and 
indirect  network  effects,  contributes  to  the  further  consolidation  of  the  tipping  process. 
The  practically  unlimited  scope  of  data  processing  as  such  already  indicates  an 
uncontrolled  scope  of  processing  user  data  which  represents  a  competitively  significant 
scope  of  action  in  the  market  for  social  networks  covered  by  the  provisions  of  Section 
18(3a)  no.  4  GWB. 

482  From  the  Bundeskartellamt’s  point  of  view,  access  to  competitively  relevant  data  is  an 
important  aspect  in  the  assessment  of  market  power  of  social  networks  because  the 


468  The  economic  literature  also  refers  to  this  joint  effect  as  “increasing  returns”,  cf.  Arthur,  Increasing  Returns  and 
the  New  World  of  Business,  https://hbr.org/1996/07/increasina-returns-and-the-new-world-of-business  (last 
accessed  on  1 0  January  201 9). 
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product  in  question  is  a  strongly  data-driven  product  whose  characteristics  and  financial 
sustainability  depend  to  a  significant  degree  on  the  personal  user  data  available.  A 
large  data  base  of  a  market  participant  as  such  is  not  an  indication  of  market  power.  It 
can,  however,  play  an  important  role  in  the  overall  assessment  of  all  circumstances.469 
The  high  competitive  relevance  of  the  data  base  to  a  supplier  of  social  networks  will, 
however,  create  an  additional  barrier  to  market  entry  as  most  competitors,  with  the 
exception  of  Google,  cannot  collect  comparable  amounts  of  data,  or  data  with  a 
comparable  level  of  detail,  as  Facebook.  This  entry  barrier  further  increases  the  lock- 
in  effect  created  by  the  direct  network  effects. 

i.  Data  sources 

483  As  described  above,  Facebook  can  use  a  large  number  of  different  data  sources.  First 
of  all  the  company  has  access  to  user  data  which  are  created  directly  when  using  a 
social  network  in  accordance  with  its  purpose.  Via  the  registration,  login  and  the  mobile 
or  desktop  use  of  Facebook. corn’s  start  page  users  already  generate  a  large  amount 
of  data  about  themselves  to  which  Facebook  has  access.  In  order  to  create  their 
profiles  users  actively  provide  data  including  their  real  name  (real  name  policy),  age, 
sex,  relationship  status,  place  of  residence,  education,  occupation,  employer,  interests 
and  hobbies.  Users  have  a  strong  incentive  to  provide  comprehensive  and  correct  data 
as  they  mainly  use  a  social  network  to  search  for  specific  other  users,  interact  with 
them  and  present  themselves.  Finding  other  users  is  considerably  facilitated  by  the 
provision  of  comprehensive  and  correct  profile  information  (e.g.  real  names). 

484  The  activities  on  the  social  network,  e.g.  posts  and  other  interactions,  provide 
Facebook  with  information  on  the  persons  the  user  communicates  with  and  the  topics 
the  user  is  interested  in.  The  live  location  feature  on  mobile  devices  and  technical 
options  for  the  geographic  mapping  of  IP  addresses  enable  Facebook  to  track  the 
locations  and  movements  of  users.  As  users  are  obliged  to  create  an  account  Facebook 
can  track  registered  users  across  devices  and  see  on  which  devices  the  social  network 
is  used.  If  users  upload  contact  lists  to  the  social  network  to  find  friends,  Facebook  will 
gain  further  information  on  the  users’  friends  and  the  persons  they  communicate  with. 

485  Facebook  also  has  access  to  data  of  persons  using  other  social  media  owned  by  the 
Facebook  group.  These  data  are  based  on  the  personal  data  of  users  which  are 
combined  and  matched  against  Facebook’s  data.  WhatsApp  with  1  billion  users 
worldwide  and  [...]  daily  active  users  in  Germany,  [...],  and  Instagram  with  more  than 


469  Bundeskartellamt,  Working  paper  “Market  power  of  Platforms  and  Networks",  June  2016,  p.  84,  Joint  paper  by 
the  Autorite  de  la  concurrence  and  the  Bundeskartellamt  on  competition  law  and  data,  May  2016. 
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[...]  daily  active  users  worldwide  and  [...]  daily  active  users  in  Germany,  are  services 
with  a  large  reach  in  the  neighbouring  market  for  messaging  services. 

486  As  described  above,  Facebook  also  receives  detailed  data  on  the  user  behaviour  of 
Facebook  users  from  third-party  providers  which  use  the  developer  interfaces  offered 
by  Facebook.  Via  the  integration  of  Facebook  interfaces  (APIs)  which  involves  the 
placement  of  cookies  on  users’  browsers,  Facebook  can  track  the  users’  behaviour  on 
these  websites,  even  if  they  are  not  logged  into  or  registered  with  Facebook.  The  social 
plugins  (e.g.  the  “Like”  and  “Share”  buttons),  in  particular,  and  the  Facebook  login  are 
integrated  and  used  in  third-party  websites  or  apps  in  millions  of  cases470  in  Germany. 
The  measuring  and  analysis  tools  for  third-party  providers  also  represent  an  important 
data  source.  These  tools  transmit  to  the  Facebook  servers  the  IP  address,  type  of 
browser,  the  URLs  of  the  websites  visited,  the  time  at  which  a  website  was  visited  and 
other  information  by  means  of  combining  the  integrated  interface  and  cookies.  The  ID 
integrated  in  the  cookies  makes  it  possible  to  identify  the  Facebook.com  user  profile. 
Facebook  cookies  contain  e.g.  the  user’s  specific  ID,  the  browser  ID,  the  timestamp 
and  several  other  data.  In  mobile  apps  Facebook  can  also  identify  users  by  capturing 
the  advertising  ID  of  the  operating  system  without  the  use  of  cookies.  In  this  way 
Facebook  gains  further  information  such  as  the  Facebook  App  ID  and  metadata  such 
as  the  operating  system  used,  the  name  and  version  of  the  app  used,  etc. 

487  And  finally  the  advertisers  represent  a  further  source  of  data  for  Facebook.  As 
described  above,  the  identification  of  target  groups  (“custom  audiences”,  “Facebook 
Offline  Events”)  requires  an  upload  of  the  advertisers’  hashed  customer  data  which  will 
be  matched  against  Facebook  data.  For  this  purpose  advertisers  use  their  own 
customer  lists  that  include  data  collected  by  themselves,  e.g.  first  and  last  name, 
telephone  number,  e-mail  addresses,  city  and  country  of  residence,  date  of  birth,  age, 
sex,  purchasing  behaviour,  purchase  price  and  several  IDs  of  their  customers. 

ii.  Competitive  relevance  of  data 

488  Facebook’s  data  sources  are  highly  relevant  for  competition  because  the  product  of  a 
social  network  is  driven  by  personal  data  in  particular,  and  the  algorithms  used  for 
interaction  ultimately  define  the  product  as  a  provision  of  data  to  the  users.  Superior 
access  to  these  data  makes  it  possible  to  continuously  adapt  the  products  by  further 
technical  developments  and  improved  personalisation  and  to  achieve  other  strategic 
business  goals.  Data  sources  also  secure  funding  through  advertising  which,  if  based 
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on  these  data,  can  be  precisely  targeted  and  continuously  refined.  In  turn,  advertising 
generates  new  user  data. 

489  Personal  data  are  first  of  all  used  for  personalised  content  in  the  News  Feed.  The  news 
feed,  which  most  of  the  current  networks  are  now  using  in  similar  form,  is  a 
personalised  stream  of  content  and  activities  relating  to  the  user.  For  an  optimum  user 
experience,  users  should  mainly  be  able  to  see  content  most  relevant  to  them  when 
they  scroll  down  their  news  feed.  All  posts  are  therefore  ranked  by  an  algorithm  and 
sorted  according  to  this  ranking.  In  order  to  continuously  improve  the  news  feed 
algorithm  it  is  subject  to  a  permanent  complex  process  of  adjustment  and  modification 
based  on  different  influencing  factors,  for  example  the  data  collected.  For  each 
individual  user  the  algorithm  calculates  a  score  for  each  possible  post  to  the  news  feed 
on  the  basis  of  all  factors  that  have  a  positive  or  negative  influence  on  the  presumed 
relevance  of  a  post.  On  this  basis  the  content  in  each  user’s  personal  news  feed  is 
sorted. 

490  Three  of  the  main  factors  influencing  the  score  are  affinity,  weight  and  decay.  Affinity 
means  the  user’s  affinity  to  the  acting  person.  It  is  defined  on  the  basis  of  the  interaction 
with  the  respective  users  and  their  posts.  Indicators  include  contact  in  the  form  of  posts 
to  the  timeline,  likes,  comments,  mutual  tags,  visit  to  websites,  etc.  Overlaps  with 
regard  to  the  users’  interests,  friends  and  action  patterns  are  also  relevant.  Weight 
means  the  significance  of  a  post  from  the  users’  perspective.  The  assessment  is  based 
on  the  interaction  of  others  with  the  respective  post  in  the  form  of  clicks,  likes,  shares 
and  comments  and  even  the  content  of  the  interaction.  Personal  factors  such  as  the 
relevance  of  the  persons  who  interacted  with  the  post  play  a  role  as  well  as  the  click/like 
or  click/share  quotas.  These  quotas  have  a  negative  influence  on  the  post’s  relevance 
and,  among  many  other  factors,  they  are  meant  to  counteract  the  spread  of  spam  and 
click  baits.  If  the  same  content  was  also  shared  by  other  persons  (friends  or  third 
parties),  this  indicates  higher  weight.  Decay  refers  to  the  expiration  time  of  a  post. 
Recent  posts  are  seen  as  potentially  more  interesting  than  older  ones.  It  will  also  be 
taken  into  account,  however,  whether  a  post  is  only  interesting  in  the  present  situation 
or  whether  it  will  remain  relevant  for  a  longer  period.  This  is  assessed  e.g.  by  looking 
at  the  reaction  (short-term  and  intensive  or  long-term  and  constant).  The  type  of  content 
is  also  important,  e.g.  whether  the  post  consists  of  an  image,  video,  text,  link,  etc.  If 
users  can  be  observed  to  react  intensively  to  images,  but  rarely  click  on  links,  images 
seem  to  be  more  interesting  to  them  and  will  be  ranked  higher. 

491  The  list  of  influencing  factors  can  be  easily  extended.  Apart  from  a  user’s  own 
behaviour,  the  behaviour  of  the  users  who  post  or  interact  is  also  highly  significant. 
Interactions  of  persons  who  rarely  use  Facebook.com  are  potentially  more  relevant 
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than  those  of  power  users.  In  addition  to  these  factors,  non-behavioural  factors  also 
play  a  role,  e.g.  the  quality  of  internet  connectivity.  Facebook. corn’s  focus  and  the 
corporate  policy  can  also  have  an  influence  on  the  algorithm  and  the  position  of  posts 
in  the  news  feed.  It  is  possible,  for  example,  to  control  whether  posts  by  friends 
(personal  character)  or  posts  by  commercial  websites  (news  character)  should 
generally  be  ranked  higher.  Also,  the  algorithm  generally  ranks  new  Facebook.com 
features  higher  and  thus  promotes  them. 

492  Moreover,  the  data  collected  particularly  serve  to  provide  targeted  advertising.  The 
diverse  data  sources  make  it  possible  to  carry  out  very  detailed  targeting  procedures 
by  establishing  target  groups  according  to  specific  personal  criteria  or  consisting  of 
individually  identified  persons  (custom  audiences  and  lookalike  audiences).  Important 
targeting  methods  such  as  technical  targeting,  so-called  behavioral  targeting,  semantic 
targeting  and  re-targeting  can  be  combined  and  granular  data  sets  can  be  used. 

493  Contrary  to  Facebook’s  view  it  is  unlikely  that  the  marginal  utility  of  the  data  volume  will 
always  decrease  with  increasing  data  collection.471  This  may  be  somewhat  different  in 
the  case  of  targeted  advertising  where  the  benefit  ultimately  depends  on  the  customer’s 
decision  on  which  product  is  to  be  advertised.  As  far  as  the  further  development  of  the 
service  and  future  business  purposes  and  technologies  are  concerned,  a  diminishing 
marginal  utility  of  the  data  volume  is  not  evident,  as  stated  by  Facebook  itself.  This 
applies  in  view  of  the  further  development  of  the  possibilities  to  analyse  large  amounts 
of  data,  such  as  in  particular  Artificial  Intelligence472,  so-called  Deep  Learning  or,  more 
generally,  Machine  Learning473,  which  provide  possibilities  for  new  business  purposes 
and  areas  of  application,  and  which  in  return  require  large  amounts  of  data.474  In  its 
data  processing  guidelines  for  Facebook.com  Facebook  states  that  the  information  is 
used  for  the  further  development  of  the  products,  product  research  and  development 
as  well  as  research  and  innovations  on,  e.g.,  issues  regarding  technological  progress 
which  is  presented  as  a  general  welfare  issue.  In  another  context  Facebook  also  argues 
that  the  exactness  and  degree  of  personalisation  of  a  social  network  depended  on  the 
number  and  variety  of  the  signals  received  -  the  broader  the  database,  the  more 
effective  the  service.475 


471 

472  Artificial  intelligence  is  generally  defined  as  the  ability  of  machines  to  not  only  control  mechanical  processes  but 
also  perform  complex  mental  processes;  an  early  foundation  of  Al  is  considered  to  have  been  laid  by  the  paper 
of  Alan  M.  Turing,  Computing  Machinery  and  Intelligence,  1950,  published  in  the  journal  Mind,  1  October  1950, 
p.  433-460. 

473  Deep  Learning  and  Machine  Learning  are  different  methods  by  which  adaptive  algorithms  can  be  “trained”  to 
improve  in  the  course  of  their  application. 

474  See  also  Bundeskartellamt/Autorite  de  la  Concurrence,  “Competition  Law  and  Data",  May  2016,  p.  50. 

475  [■■■] 
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iii.  Establishment  of  a  further  barrier  to  market  entry 

494  In  the  context  of  the  direct  and  indirect  network  effects  and  the  ensuing  lock-in  effect, 
superior  access  to  competitively  relevant  data  establishes  a  further  barrier  for  entry  to 
the  market  for  social  networks  and  thus  also  contributes  to  a  market  tipping  process. 

495  Due  to  the  direct  and  indirect  network  effects,  Facebook  has  already  achieved  a  huge 
data  advantage  which  most  of  its  competitors,  particularly  new  entrants,  cannot  catch 
up  with.  This  is  mainly  due  to  the  superior  installed  base  which  is  the  foundation  of  the 
data  sources  described  above  and  which  none  of  the  competitors  was  able  to  achieve. 
Its  installed  base  of  23  million  daily  active  users476  enables  Facebook  to  collect  a  huge 
amount  of  data.  It  is  a  special  characteristic  of  these  data  that  their  usability  and  value 
are  not  merely  a  product  of  the  data  themselves,  but  mainly  result  from  their 
combination  and  formation  of  patterns.  The  value  of  each  single  data  element  and  the 
possibility  of  gaining  insights  from  these  data  increases  with  an  increasing  amount  of 
other  data  elements  available.  By  means  of  algorithms  the  behaviour  or  the  interests 
of  a  user  can  thus  be  predicted.  With  an  increasing  amount  of  data  available  (user- 
based  data,  but  also  data  on  the  overall  community)  the  prediction  can  be  made  more 
and  more  precisely  and  to  the  point.  The  benefit  continuously  increases  with  larger 
amounts  of  data  available,  especially  if  they  are  derived  from  different  sources. 

496  Facebook  has  a  significant  advantage  over  its  competitors  in  the  optimisation  of  its 
news  feed  algorithm  and  thus  in  the  development  and  improvement  of  its  product,  and 
this  advantage  increases  as  the  installed  base  grows.  This  can  also  be  seen  as  a 
further  aspect  of  the  self-reinforcing  feedback  loop  as  an  increased  installed  user  base 
improves  the  data  base  which  generally  further  increases  the  benefit  each  user  derives 
from  the  network,  which  in  turn  attracts  new  users.477  The  increasing  benefit  of  the 
network  increases  the  lock-in  effect  resulting  from  the  direct  network  effects  and 
incompatibility. 

497  Moreover,  via  indirect  network  effects,  the  increasing  installed  base  and  the  ensuing 
amount  of  data  have  an  impact  on  the  advertisers’  side  of  the  market.  If  a  large  number 
of  highly  interactive  users  spend  much  time  on  the  Facebook  website,  this  improves 
targeting  options  which  in  turn  attracts  a  large  number  of  advertisers  who  contribute 
their  own  data  sources,  generate  further  data  by  means  of  the  Facebook  measurement 
tool  and  make  these  available  to  Facebook.  The  Bundeskartellamt’s  investigations 
have  shown  that  the  data  Facebook  collected  and  made  available  for  advertising 

476  https://de.newsroom.fb.com/news/2017/Q6/eine-communitv-von-30-millionen-facebook-saat-danke/ _ (in 

German,  last  accessed  on  10  January  2019). 

477  Cf.  Joint  paper  by  the  French  Autorite  de  la  concurrence  and  the  Bundeskartellamt  on  competition  law  and  data, 
May  2016,  p.  13. 
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purposes  were  considered  an  important  advantage  of  advertising  on  Facebook  by  the 
companies  surveyed,  besides  the  service’s  wide  coverage.  11  out  of  13  media 
agencies  which  responded  to  the  questionnaire  said  that  advertising  on  Facebook 
offered  good  targeting  opportunities  or  very  detailed  user  data,  which  was  an 
advantage  over  other  social  media  services.  A  large  number  of  advertisers  also 
consider  the  good  targeting  options  and  comprehensive  “granular”  user  data  to  be  an 
advantage  of  advertising  on  Facebook  as  compared  to  other  media.478 

498  Competitors  are  largely  unable  to  duplicate  this  data  collection.  This  applies  in 
particular  to  smaller  competitors  that  only  have  limited  options  for  pooling  data  from 
different  relevant  sources.  All  internet  companies  use  cookie  technologies  and  acquire 
data  from  third  party  providers.  Flowever,  the  competitors’  sources  are  not  comparable 
to  the  data  sources  available  to  Facebook  through  the  user  base  of  the  social  network 
and  its  own  services.  According  to  the  investigations,  the  Facebook’s  competitors,  with 
the  exception  of  Google,  cannot  pool  data  from  company-owned  services.  In  the  sector 
of  social  networks,  Google  was  the  only  company  apart  from  Facebook  to  offer  third 
party  websites  the  share  and  like  buttons  and  a  log-in  button. 

499  The  Bundeskartellamt’s  investigations  in  the  sector  of  advertisers  have  also  shown  that 
Facebook  has  a  unique  treasure  trove  of  data:  12  of  13  of  the  media  agencies  that 
replied  to  this  question  said  Facebook  possessed  data  relevant  for  advertising  that 
other  providers  of  online  advertising  could  not  deliver.  Most  agencies  stated  that 
Facebook  had  more  detailed  data  than  other  providers.  Some  agencies  also  said  that 
Facebook  possessed  unique  data  about  the  interests  of  users.  A  large  majority  of  the 
advertising  companies  also  share  the  opinion  that  Facebook  possesses  more  data  than 
other  publishers.  They  often  referred  to  data  about  the  users’  interests,  very  fine¬ 
grained  details  and  user-based  profile  information.479 

500  The  fact  that  the  Google  group,  which  included  Google+  in  its  portfolio,  also  has 
extensive  access  to  data  does  not  change  the  significance  of  Facebook’s  access  to 
data  with  regard  to  its  market  position  in  the  market  for  social  networks.  Data  access  is 
connected  with  the  network  effects  and  represents  a  further  aspect  in  the  overall 
assessment.  The  collection  of  data  available  to  the  Google  group,  i.e.  data  from  Google 
Search,  YouTube,  G-Mail,  Google  Maps,  Android  and  other  services,  which  is  also 
pooled  based  on  Google’s  respective  data  processing  policies480,  is  on  the  whole  at 
least  comparable  with  Facebook’s  collection  of  data  in  terms  of  volume  and  level  of 


478  [...] 

479  [■■■] 

480  https://www.google.de/intl/de  de/policies/privacv/?fq=1#infouse  (last  accessed  on  1 0  January  201 9). 
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detail.  However,  in  the  case  of  the  private  social  network  Google+,  this  data  base  has 
not  led  to  market  success  as  it  was  not  linked  with  strong,  self-reinforcing  direct  network 
effects.  In  contrast  to  Facebook,  Google-i-  was  not  the  central  Google  service  for  which 
data  from  other  services  and  sources  were  combined  for  the  benefit  of  its  algorithms 
and  funding  through  advertising.  Google+  was  rather  one  of  the  data  sources  the 
company  tapped  into  in  order  to  provide  online  advertising  in  the  other,  considerably 
more  important  Google  services.  Google-i-  users  did  not  receive  any  ads. 

(e)  Innovation-driven  competitive  pressure,  Section  18(3a)  no.  5  GWB 

501  Facebook’s  market  position  is  currently  not  threatened  by  sufficient  innovation-driven 
competitive  pressure.  Under  Section  18(3a)  no.  5  GWB,  account  must  be  taken  of 
innovation-driven  competitive  pressure  in  the  assessment  of  an  undertaking’s  market 
position,  in  particular  in  the  case  of  multi-sided  markets  and  networks.  In  contrast  to 
merger  control,  the  issue  here  is  not  whether  and  to  what  extent  the  innovation-driven 
competition  between  companies  is  threatened481,  but  to  what  extent  innovations  can 
put  into  perspective  the  market  power  of  a  company.482 

502  The  Internet  is  generally  highly  dynamic  and  characterised  by  a  large  amount  of 
innovations.  Innovative  products  and  services  can  create  and  establish  new  digital 
markets  within  a  short  period  of  time.  However,  these  dynamics  can  also  result  in  online 
services  rapidly  losing  their  significance.  Crucial  factors  in  this  process  are 
characteristic  features  of  the  internet,  i.e.  global  networking  and  accessibility  as  well  as 
high-speed  innovations.483  The  user  behaviour  of  private  users  is  also  subject  to 
change,  in  particular  in  view  of  technical  innovations.484 

503  The  innovative  and  disruptive  potential  of  the  internet  cannot  be  used  as  a  general 
argument  against  the  market  power  of  internet  companies.  If  a  strong  market  position 
exists  which  has  been  established  according  to  further  criteria  defining  market  power, 
this  position  can  only  be  effectively  put  into  perspective  on  the  basis  of  concrete 


481  See  Commission,  “Dow/Dupont“,  Comp./M.  7932,  decision  of  27  March  2017  in  which  the  Commission  held 
that  the  merger  would  result  in  a  significant  reduction  of  innovation  competition  in  the  markets  for  pesticides. 
The  merger  was  only  cleared  subject  to  conditions. 

482  See  Bundeskartellamt,  Series  of  papers  on  Competition  and  Consumer  Protection  in  the  Digital  Economy, 
“Innovations  -  Challenges  for  competition  law  practice”,  November  201 7,  in  particular  p.  1 6ff . , 
https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Schriftenreihe  Digitales  II. pdf?  blob=publicati 

onFile&v=3  (last  accessed  on  1 0  January  201 9). 

483  Evans,  “Multisided  Platforms,  Dynamic  Competition  and  the  Assessment  of  Market  Power  for  Internet-based 

firms”,  2016, 

http://chicaqounbound.uchicaao.edu/cai/viewcontent.cai?article=2468&context=law  and  economics,  p.  10 

(last  accessed  on  10  January  2019). 

484  Bundeskartellamt,  decision  of  22  October  201 5  -  B6-57/1 5  -  Parship/Elitepartner ,  para.  1 74;  Working  paper, 
p.  74f.;  See  Bundeskartellamt,  Series  of  papers  on  Competition  and  Consumer  Protection  in  the  Digital 
Economy,  “Innovations  -  Challenges  for  competition  law  practice”,  November  2017,  in  particular  p.  24 
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indications  in  each  individual  case  of  a  dynamic  or  disruptive  process  which  could  also 
originate  from  markets  other  than  the  relevant  one.  An  abstract  challenge  expected  to 
take  place  at  some  unspecified  point  in  the  future  will  not  be  sufficient.  This  applies  in 
particular  to  the  control  of  abuse  of  dominant  positions  which  focuses  on  the  current 
situation.  Also  in  the  digital  economy  it  is  possible  to  establish  market  positions  that  are 
largely  secured  over  long  periods  of  time,  in  particular  by  direct  and  indirect  network 
effects.  During  these  periods  the  abuse  of  a  dominant  position  cannot  be  accepted  only 
because  the  situation  can  be  assumed  to  change  in  the  future.485 

504  There  is  no  sufficient  innovation-driven  competitive  pressure,  also  from  other, 
neighbouring  markets,  that  would,  currently  or  in  the  near  future,  be  able  to  effectively 
put  into  perspective  Facebook’s  market  position  in  the  market  for  social  networks.  The 
high  market  shares  and  market  share  leads  described  above  already  indicate  that 
neither  technical  disruptions  such  as  the  “mobile  revolution”  initiated  by  the 
development  of  smartphones  nor  competitive  moves  by  competitors  have  built  up 
innovation-driven  pressure  on  Facebook’s  market  position.  The  innovative  impulses 
provided  in  particular  by  competition  from  substitutes  from  neighbouring  markets  where 
competitors  innovated  and  extended  their  own  social  media,  could  be  counteracted  by 
Facebook  by  integrating  the  innovation  into  its  own  portfolio. 

505  The  recent  development  of  mobile  internet  use  has  brought  about  an  important  and 
fundamental  change  of  user  behaviour  in  almost  all  areas.  The  fast  growing  and 
massive  use  of  smartphones,  which  has  rapidly  developed  since  the  introduction  of  the 
iPhone  in  2007,  is  generally  used  as  a  typical  example  of  a  “disruption”  which  has  been 
threatening  business  models  and  products.  However,  Facebook  has  not  been  affected 
by  this  development  although  the  social  network  was  originally  designed  to  be  used  on 
desktop  computers.  With  the  introduction  of  the  iPhone  in  2007  the  company  merely 
launched  a  mobile  version  of  the  website  optimised  for  small  displays,  and  mobile  apps 
for  iOS  and  Android  were  only  available  on  the  market  from  201 2. 486  StudiVZ  had 
already  made  a  mobile  app  available  in  2008.  Nevertheless  the  mobile  use  of  Facebook 
has  been  increasing  continuously487  and,  according  to  public  statistics,  already  reached 
more  than  50%  (worldwide)  in  the  year  it  was  launched.488 


485  Bundeskartellamt,  decision  of  22  October  201 5  -  B6-57/1 5  -  Parship/Elitepartner ,  para.  1 76;  Bundeskartellamt 
working  paper  "Market  Power  of  Platforms  and  Networks",  June  2016,  p.  74f. 

486  [...] 

487  [...] 

488  Cf.  https://de.statista.com/infografik/1077/facebooks-mobile-nutzer/7utm  campaiqn=9b9cd60d6e- 

Cold  Camp  InfographTicker  DE  pm  36&utm  medium=email&utm  spurce=lnfographic%20Newsletter&utm 

term=0  666fe64c5d-9b9cd60d6e-295265921  (available  in  German  only,  last  accessed  on  10  January  2019). 
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506  The  company’s  own  innovations  [,..]489  do  not  indicate  any  competitive  pressure  that 
would  have  been  able  to  challenge  Facebook’s  market  position  so  far  either. 

507  Facebook  points  out  product  innovations  launched  during  the  last  5  years  which, 
according  to  the  company,  included  the  successful  transformation  of  a  “web  company” 
into  a  “mobile  first  company”  (2012/13),  the  successful  decoupling  of  the  Facebook 
Messenger  in  April  2014,  the  launch  of  “live  video”  in  April  2016,  and  the  introduction 
of  the  privacy  settings  at  the  level  of  individual  objects  as  well  as  ads  settings  (“ad 
preferences”).  [...] 

508  In  the  area  of  photos,  Facebook  claims  [. . .].  According  to  Facebook  it  launched  “Poke” 
[...]  and  discontinued  the  feature  in  May  2014.  In  August  2016,  [...],  Facebook  had 
introduced  “Stories”  on  Instagram.  According  to  the  company,  its  “Camera”  app  had 
been  introduced  in  May  2012  and  discontinued  in  2014.  Facebook.com  had  launched 
photo  filters  and  360  Photo  in  June  2016  [...].  In  June  2015,  it  had  published  the 
“Moments”  app  which  organised  photos  and  turned  them  into  clips.  In  June  2016, 
Facebook.com  added  “Slideshow”  which  creates  mini-movies  from  photos. 

509  As  to  the  communications  sector,  Facebook  [...]  developing  the  Facebook  Messenger 
as  a  stand-alone  app.  Further  features,  such  as  following  brands,  persons  or  event  as 
well  as  order  and/or  payments  features  had  been  offered  by  the  Facebook  Messenger. 
Chatbots  had  been  introduced  in  the  market  as  new  developments.  “Lite”  versions  of 
services  had  been  introduced  for  slower  internet  access,  especially  in  developing 
countries. 

510  In  the  area  of  content  sharing,  Facebook  claims  that  innovations  had  been  introduced 
with  the  so-called  Pinboard  instead  of  a  news  feed  by  Pinterest  and  that  a  re-design  of 
YouTube  had  been  carried  out  based  on  Facebook.com.  In  September  2011, 
Facebook  had  launched  its  Timeline  which  many  other  services  also  offered  today.  In 
September  2006,  the  News  Feed  had  been  introduced.  Facebook  states  that 
“Trending”  had  been  introduced  in  January  2014  [...].  The  “Subscribe”  function  had 
been  introduced  in  September  [...].  The  “Paper”  app,  a  separate  news  app  for  iOS,  had 
been  launched  in  February  2014  and  discontinued  in  June  2016. 

511  In  2010,  Facebook  had  introduced  its  social  plugins  to  enable  interaction  between 
users;  in  2016  the  “Like”  button  had  been  revamped.  Furthermore,  Facebook  states 
that  it  had  entered  the  area  of  services  for  publishers  in  2015,  [...].  Facebook  also 
states  that  several  different  innovations  had  been  introduced  for  the  developer  platform 
and  advertising  services,  such  as  the  introduction  of  the  App  Center,  the  “Home”  meta 


[...] 
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app,  the  2012  introduction  of  the  developer  platform  for  the  Facebook  Messenger  and 
Facebook  Custom  Audiences,  and  the  Lookalike  Audiences  tool  introduced  in  2013, 
including  integrated  information  gained  from  tracking. 

512  In  the  Bundeskartellamt’s  view,  the  further  developments  described  above  in  fact 
represent  a  competitive  activity  which,  however,  does  not  go  further  than  competition 
from  substitutes  by  means  of  some  individual  marginal  features.  A  substantial  part  of 
Facebook’s  statements  describe  competitive  activities  in  other  markets  to  which 
Facebook  has  reacted  by  introducing  innovations  on  Instagram  and  the  Facebook 
Messenger  as  stand-alone  app,  as  well  as  via  WhatsApp  or  other  separate  apps  such 
as  “Poke”,  “Paper”,  “Moments”  or  “Facebook  Camera”  rather  than  in  the  area  of  the 
social  network.  In  contrast  to  Facebook’s  claim,  this  represents  different  reactions  in 
the  individual  separate  markets  concerned,  in  some  cases  market  entries  such  as  the 
introduction  of  the  separate  Facebook  Messenger  app,  rather  than  a  reaction  taking 
place  in  the  social  network  market.  These  reactions  are  rather  attributable  to 
Facebook’s  substantial  scope  for  expansion  which  arises  precisely  from  its  strong 
market  position  in  the  social  networks. 

513  Where  Facebook  claims  that  relatively  fundamental  developments  and  features  of  the 
social  network  took  place  in  2006  and  2011,  as  e.g.  the  Newsfeed  that  was  launched 
in  2006,  the  social  plugins  introduced  in  2010  or  the  timeline  in  2011,  this  shows  that 
Facebook  successfully  entered  the  market.  The  Bundeskartellamt  does  not  dispute  that 
there  has  been  intensive  competition  for  this  market. 

514  Where  Facebook  refers  to  recent  developments  in  the  social  network,  in  particular  the 
streaming  of  videos  via  Facebook  Live,  the  upload  of  360 “videos  and  photos,  Trending 
or  the  revamp  of  the  Like  button,  [. . .].  Although  this  demonstrates  competitive  pressure 
on  some  partial  functions  of  a  social  network,  the  developments  still  represent 
competition  from  substitutes  at  the  margins  of  the  market  which,  contrary  to  the  view 
held  by  Facebook,  cannot  challenge  Facebook’s  position  in  the  market.  In  the  opinion 
of  the  Bundeskartellamt  it  is  not  justified  to  refer  to  competition  on  video  features  as  a 
“video  revolution”  that  would  be  comparable  to  the  “mobile  revolution”.  Also  in  the  video 
sector  Facebook  is  able  to  implement  the  same  or  similar  features  very  quickly,  which 
ultimately  means  that  the  innovation  resulting  from  competition  from  substitutes  will 
only  have  a  minor  effect  in  the  market  for  social  networks.  This  also  indicates  a  market 
position  which  is  hard  to  challenge  and  which  can  immediately  fend  off  competitive 
moves  by  YouT ube,  the  leading  competitor  in  this  sector,  even  those  addressing  partial 
features. 
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51 5  Facebook’s  statements  on  innovations  in  online  advertising  and  the  developer  platform 
are  only  indirectly  relevant  to  the  user  market.  The  innovations  mainly  represent  a 
better  possibility  for  monetisation  and  data  collection  as  a  reflection  of  market  success 
on  the  user  side.  The  development  of  additional  apps  users  can  use  within  the  social 
network  is  certainly  an  advantageous  development  of  the  network.  However,  this  does 
not  depend  on  Facebook,  but  above  all  on  the  creativity  of  the  developers.  For 
Facebook,  the  success  of  such  interfaces  is  closely  connected  with  the  intensive 
network  effect  achieved  which  makes  the  development  of  additional  apps  by  third  party 
suppliers  attractive,  and  which  in  turn  makes  the  network  more  attractive  for  users.  The 
quality  or  innovations  achieved  by  apps  for  Facebook  and  the  existing  network  effects 
thus  reinforce  each  other,  a  circumstance  which  makes  it  even  more  difficult  to 
challenge  Facebook’s  market  position.490 

516  Against  this  background  it  is  not  convincing  that  Facebook  points  out  its  investments  in 
research  and  development491  as  the  Bundeskartellamt  does  not  deny  that  the  company 
has  reacted  to  innovations  by  competitors  in  neighbouring  markets.  The  nature  of  these 
investments  is  not  evident  from  the  statement  either,  except  in  the  case  of  the  product 
developments  already  mentioned  by  Facebook  in  the  course  of  the  proceedings. 

517  Contrary  to  the  view  held  by  Facebook,  the  mere  possibility  of  Facebook  having  to  react 
to  innovations  by  competitors  in  some  features  and  the  fact  that  it  cannot  remain 
stagnant  at  a  certain  product  level  of  the  social  network,  cannot  refute  market 
dominance.  To  prove  market  dominance  it  is  not  necessary  to  demonstrate  lower 
technical  quality,  less  investment  in  research  and  development  and  delay  in  market 
launch.492  Particularly  in  view  of  the  provisions  of  Section  18(3a)  GWB,  the  ability  to 
immediately  counter  competitive  moves  from  outside  is  also  a  manifestation  of  market 
power  in  the  online  sector.  What  is  decisive  in  this  respect  is  the  pressure  that 
competitors  in  the  area  of  the  innovations  can  actually  exert  on  the  market  position. 
This  pressure  is  weak  if  the  innovative  activity,  which  was  in  fact  noticeable,  ultimately 
cannot  take  effect  because  of  a  rapid  response.  For  this  reason  alone  it  is  not 
convincing  that  Facebook  refers  to  Myspace  which  had  failed  to  introduce  innovations 
in  2009  and  exited  the  market  because  of  this  failure.  Besides,  social  media  were  still 
in  development  at  that  time  and  exposed  to  competition  for  the  market  (see  above 
432ff .). 


490  Cf.  Shy,  ..Technology  revolutions  in  the  presence  of  network  externalities“,  International  Journal  of  Industrial 
Organization,  1996,  14,  p.  785-800;  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and 
Networks”,  June  2016,  p.  72f. 

491 
492 
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518  Furthermore,  the  scope  of  action  which  characterises  market  dominance  not  only 
includes  the  scope  for  innovation  or  investment  activities.  As  described  above  (para. 
379ff.),  the  scope  for  data  processing,  which  is  not  affected  by  the  innovation  activity 
and  product  improvement  described  in  the  statement,  is  also  part  of  the  scope  of  action 
a  dominant  advertising-funded  social  network  has  vis-a-vis  private  users. 

51 9  This  does  not  mean  that  a  monopoly  in  a  network  market,  as  represented  by  the  social 
networks,  cannot  be  challenged  at  all.  In  the  case  of  direct  network  effects  with  the 
lock-in  effect  described  above,  an  attack  can  only  succeed  if  the  users  are  prepared  to 
incur  high  switching  costs.  This  can  only  be  achieved  by  innovations  if  they  are 
substitutable  with  the  network  effects.493  From  the  users’  perspective,  however,  the 
improvement  of  individual  features,  which  can  also  be  easily  reproduced,  cannot 
substitute  the  network  effect.  This  was  also  confirmed  by  the  user  survey. 

520  As  described  above,  Facebook  users  were  asked  to  state  reasons  for  which  they  might 
consider  using  services  other  than  Facebook.  It  was  possible  to  list  several  reasons. 
The  reason  indicated  by  76%  of  the  users  was  that  their  friends  were  using  the  other 
service.  Only  35%  of  the  users  would  be  inclined  to  make  more  use  of  the  other  service 
if  it  provided  “better  features”.494 

521  Nevertheless,  in  the  opinion  of  the  Bundeskartellamt  it  cannot  be  excluded  that  future 
innovations  and  product  developments  could  challenge  Facebook’s  position  or  even 
start  a  process  of  replacement.  At  this  point,  however,  there  are  no  specific  indications 
of  such  a  development.  Despite  the  substantial  innovative  power  of  the  internet  and  the 
dynamics  this  can  involve,  there  have  been  no  indications  during  the  last  seven  years 
of  any  replacement  trends  or  any  relevant  market  share  losses  for  Facebook. 


493  Cf.  Shy,  "Technology  revolutions  in  the  presence  of  network  externalities",  International  Journal  of  Industrial 
Organization,  1996,  14,  p.  785-800;  Bundeskartellamt,  Working  paper  "Market  Power  of  Platforms  and 
Networks",  June  2016,  p.  72f. 

494  [...]  Cf.  also  the  statement  by  Paul  Adams,  former  Google+  employee:  “What people  failed  to  understand  was 
Facebook  had  network  effects , "  says  Adams,  the  former  Google+  user  experience  employee.  "It’s  like  you  have 
this  grungy  night  club  and  people  are  having  a  good  time  and  you  build  something  next  door  that’s  shiny  and 
new,  and  technically  better  in  some  ways,  but  who  wants  to  leave?  People  didn't  need  another  version  of 
Facebook."  at  http://mashable.eom/2015/08/02/qooqle-plus-historv/#pZVT825xesqH  (last  accessed  on  10 
January  2019). 
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II.  Imposing  abusive  business  terms  pursuant  to  Section  19(1)  GWB 

522  As  explained  in  the  operative  part  of  the  decision,  the  assessment  of  abuse  of  a 
dominant  position  focuses  on  conditions  which  make  the  use  of  the  social  network  by 
users  residing  in  Germany  conditional  on  Facebook  being  able  to  gather  user-related 
and  device-related  data  that  were  gathered  and  saved  during  the  use  of  the  services 
WhatsApp,  Oculus,  Masquerade  and  Instagram,  as  well  as  user-related  and  device- 
related  data  on  Facebook  Business  Tools,  and  combine  them  without  the  users’ 
consent  with  those  data  that  were  gathered  and  saved  during  their  use  of 
Facebook.com.  The  question  remains  open  as  to  whether  it  is  also  inappropriate  to 
collect  and  use  user  data  which  result  from  the  use  of  Facebook  services  for  which 
private  users  are  obliged  to  register  under  Facebook’s  terms  and  conditions.  The 
conditions  relating  to  the  data  processing  procedures  in  the  context  of  Facebook 
accounts  due  to  mandatory  registration  with  Facebook.com  are  not  the  subject  of  the 
present  assessment  of  abuse  of  a  dominant  position.  Apart  from  Facebook.com  this 
also  includes  the  Facebook  Messenger.  After  due  consideration  of  the  circumstances 
the  Bundeskartellamt  exercises  its  discretion  to  refrain  from  carrying  out  an 
assessment  of  abuse  of  a  dominant  position  pursuant  to  Section  19  GWB. 

523  The  use  and  implementation  of  the  terms  of  service,  which  are  specified  in  the  data 
and  cookies  policies  or  comparable  contractual  documents  and  as  described  in  detail 
in  the  operative  part,  constitutes  an  abuse  of  a  dominant  position  on  the  market  for 
social  networks  for  private  users  in  the  form  of  abusive  business  terms  pursuant  to  the 
general  clause  of  Section  19(1)  GWB  because,  as  a  manifestation  of  market  power, 
these  terms  violate  the  principles  of  the  GDPR. 

524  Based  on  the  case-law  of  the  Federal  Court  of  Justice,  in  particular  its  decision  in  the 
VBL-Gegenwert  cases,  Section  19(1)  GWB  is  also  applicable  to  the  use  of  data 
processing  terms  which,  as  a  manifestation  of  market  power,  violate  data  protection 
rules.  It  is  not  blocked  by  the  provisions  of  the  GDPR  (see  1.).  Facebook’s  data 
processing  terms  are  terms  within  the  meaning  of  Section  19  (1)  and  (2)  no.  2  GWB. 
They  must  not  be  assessed  on  the  basis  of  the  criteria  of  the  prohibition  of  abusive 
pricing  (see  2.).  The  data  processing  terms  violate,  to  the  extent  described  above,  the 
principles  of  data  protection  law  as  expressed  by  the  GDPR  (see  3.).  As  a  manifestation 
of  Facebook’s  market  power  they  are  deemed  to  be  abusive  practices,  also  after  a 
process  of  weighing  up  interests  under  competition  law  (see  4.). 
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1.  Violation  of  data  protection  principles  represents  abusive  practice 

525  According  to  the  case-law  of  the  Federal  Court  of  Justice,  the  abuse  of  a  dominant 
position  pursuant  to  Section  19(1)  GWB,  which  also  covers  the  protection  of 
consumers495,  must  be  assumed  to  exist  where  the  data  processing  terms  used  by  a 
norm  addressee,  as  a  manifestation  of  market  power,  violate  the  principles  of  the 
GDPR.  (see  a.).  Along  with  the  data  protection  law  and  its  enforcement  system,  Section 
1 9(1 )  GWB  is  fully  applicable  (see  b.). 

a.  Taking  the  GDPR  into  account  within  the  framework  Section  19(1)  GWB 

526  Abusive  business  terms  can  also  be  examined  based  on  the  general  clause  of  Section 
19(1)  GWB.  According  to  the  case-law  of  the  Federal  Court  of  Justice,  principles  from 
provisions  of  the  legal  system  that  regulate  the  appropriateness  of  conditions  agreed 
upon  in  unbalanced  negotiations  can  be  used  as  concepts  for  appropriateness  in  the 
assessment  of  abusive  practices  under  Section  19(1)  GWB.  The  principles  of  data 
protection  law  underlying  the  GDPR  are  thus  a  suitable  standard  for  measuring  the 
appropriateness  of  the  data  processing  terms  of  a  dominant  supplier,  all  the  more  so 
since  they  must  be  taken  into  account  anyway  as  a  higher-ranking  constitutional  law 
that  specifies  constitutionally  guaranteed  rights. 

527  According  to  the  Federal  Court  of  Justice,  terms  and  conditions  are  not  only  subject  to 
the  specific  standard  example  of  Section  19(2)  no.  2  GWB  and  the  concept  of 
comparable  markets  it  includes.  As  held  by  the  Federal  Court  of  Justice  in  the  VBL- 
Gegenwert  cases,  an  abusive  practice  can  also  be  found  based  on  the  general  clause 
of  Section  19(1)  GWB,  e.g.  where  general  business  terms  are  used  that  are 
inadmissible  under  the  legal  principles  of  Sections  307ff.  of  the  German  Civil  Code 
(BGB),  and  in  particular  where  these  practices  also  represent  a  manifestation  of  market 
power  or  superior  market  power.496  In  the  Pechstein  case  the  Court  left  open  whether 
the  business  terms  used  were  abusive  under  Section  19(1)  or  (2)  no.  2  GWB,  but 
considered  an  extensive  balancing  of  interests  to  be  necessary  which  should  also  take 
into  account  constitutionally  protected  rights.  Accordingly,  to  safeguard  constitutionally 
protected  rights,  Section  1 9  GWB  must  be  applied  in  cases  where  one  contractual  party 
is  so  powerful  that  it  would  be  practically  able  to  dictate  contractual  terms,  thus 
eliminating  the  other  party’s  contractual  autonomy.  If  in  such  a  case  constitutionally 


495  Federal  Court  of  Justice,  judgment  of  07.12.2010  -  KZR  5/10  -  Entega  II,  WuW/E  DE-R  3145,  31 55f.,  para.  24 
(juris);  Bechtold,  GWB,  8th  edition,  Section  19  para.  5. 

496  Federal  Court  of  Justice,  judgment  of  6  November  2013,  file  KZR  58/11,l/BL  Gegenwert  /,  para.  65  (juris); 
Federal  Court  of  Justice,  judgment  of  24  January  2017,  file  KZR  47/14,  VBL  Gegenwert  II,  para.35  (juris);  in  the 
same  direction  also  Federal  Court  of  Justice,  judgment  of  7  June  2016,  file  KZR  6/15,  Pechstein/lnternational 
Skating  Union,  para.  48  (juris). 
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guaranteed  legal  positions  are  interfered  with,  the  court  held  that  state  regulations,  in 
particular  general  clauses  under  civil  law  (Sections  1 38,  242,  307,  31 5  BGB)  which  also 
included  Section  19  GWB,  had  to  intervene  to  uphold  the  protection  of  constitutional 
rights.497  According  to  the  Court  these  clauses  should  be  applied  in  compliance  with 
the  fundamental  rights  and  by  balancing  and  restricting  the  conflicting  positions  in  such 
a  way  that  the  constitutional  rights  of  all  parties  were,  as  far  as  possible,  effectively 
maintained.498 

528  With  this  case-law,  the  Federal  Court  of  Justice  has  introduced  an  'appropriateness' 
principle  which  complements  the  comparable  markets  principle  of  Section  19(2)  no.  2 
GWB499  and  is  based  on  constitutional  values,  the  principles  of  the  legislation  on  unfair 
contract  terms  and  other  civil  law  general  clauses.500  The  key  element  here  is  an 
appropriate  balance  of  interests  in  unbalanced  negotiations  where  one  party 
unilaterally  imposes  business  terms,  as  shown  in  particular  by  the  legislation  on  unfair 
contract  terms.  The  legal  provisions  are  to  prevent  a  contractual  party  from  losing  its 
constitutionally  protected  right  to  self-determination  in  business  affairs  (contractual 
freedom)  because  the  other  party  is  able  to  unilaterally  determine  the  terms  of  the 
contract.501  Contract  terms  that  are  deemed  inadmissible  according  to  the  balancing  of 
interests  under  the  legal  principles  laid  down  e.g.  in  the  legislation  on  unfair  contract 
terms  are  also  to  be  considered  abusive  in  the  context  of  an  assessment  to  be  carried 
out  in  each  case  under  Section  19  GWB  where  a  sufficient  degree  of  market  power  is 
involved.502 

529  This  case-law,  which  was  developed  to  take  into  account  the  appropriateness  concepts 
of  Sections  307ff.  of  the  German  Civil  Code  (BGB)  within  the  framework  of  Section 
19(1)  GWB,  can  be  applied  to  all  other  principles  of  legal  provisions,  if  a  sufficient 
degree  of  market  power  is  involved  and  to  the  extent  that  the  principles  concern  the 
appropriateness  of  conditions  agreed  upon  in  unbalanced  negotiations.  It  can  be 
applied  in  particular  to  constitutional  principles  that  protect  the  right  to  informational 
self-determination  and  the  fundamental  right  to  data  protection.  For  the  same  reason, 
the  principles  of  data  protection  legislation  relating  to  the  appropriateness  of  data  use 
must  also  be  directly  applied,  as  they  are  based  on  the  fundamental  right  to  data 


497  Federal  Court  of  Justice,  judgment  of  7  June  2016,  file  KZR  6/15,  Pechstein ,  para.  55  (juris)  with  reference  to 
Federal  Constitutional  Court  81, 242,  255. 

498  Federal  Court  of  Justice,  judgment  of  7  June  2016,  file  KZR  6/15,  Pechstein,  para.  57  (juris)  with  reference  to 
Federal  Constitutional  Court  89,  214,  232. 

499  Federal  Court  of  Justice,  decision  of  6  November  1984,  KVR  13/83,  Favorit,  para.  23  (juris). 

500  See  also  Langen/Bunte/Nothdurft,  Section  19  GWB,  para.  186ff. 

501  Federal  Constitutional  Court,  decision  of  7  September  2010,  file  ref.  1  BvR  2160/09,  Gasag,  para.  34. 

502  Federal  Court  of  Justice,  decision  of  6  November  201 3  -  KZR  58/1 1 ,  VBL  Gegenwert  /;  Federal  Court  of  Justice, 
decision  of  24  January  2017  -  KZR  47/14  -  VBL  Gegenwert  II. 
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protection  under  Article  8(2)  EU  Charter  and  weigh  up  the  fundamental  right  to  data 
protection  against  the  rights  and  interests  of  the  data  processor. 

530  It  is  one  of  the  objectives  of  data  protection  law  to  counter  power  asymmetries  between 
organisations  and  individuals  and  to  carry  out  an  appropriate  balancing  of  the  interests 
between  data  controllers  and  data  subjects.503  In  order  to  protect  the  fundamental  right 
to  informational  self-determination,  data  protection  law  provides  the  individual  with  the 
right  to  decide  freely  and  without  coercion  on  the  processing  of  his  or  her  personal  data. 
This  not  only  applies  to  the  relationship  between  the  individual  and  the  State  ("public 
sector")  but  also  between  the  individual  and  private  sector  companies  ("non-public 
sector").  In  data-driven  industries  it  is  thus  the  objective  of  data  protection  law  to  protect 
individuals  from  existing  power  asymmetries.504  The  design  of  online  offers  in  the  high- 
volume  digital  business  sector  increasingly  involves  decision-making  processes  which 
the  average  consumer  cannot  realistically  be  expected  to  be  able  to  deal  with.  The 
“negotiation  processes”  between  suppliers  and  users  are  often  asymmetrical 
processes,  to  the  detriment  of  consumers.505  In  the  non-public  sector,  data  protection 
law  can  therefore  be  considered  as  a  special  economic  law  as  it  strives  to  achieve  a 
balancing  of  interests  between  data  processors  and  the  consumers,  i.e.  the  persons 
affected  by  the  processing  of  data  for  business  purposes. 

531  In  the  present  case  the  conditions  are  to  be  assessed  on  the  basis  of  the  data  protection 
law  principles  laid  down  in  the  General  Data  Protection  Regulation  (GDPR)506  which 
came  into  force  in  May  2016  and  has  taken  effect  from  25  May  2018  (Art.  99  GDPR). 
The  GDPR  replaced  the  previously  applicable  Data  Protection  Directive  95/46/EC507. 
The  relevant  provisions  of  the  GDPR  are  mandatory  law  which  leave  the  Member 
States  only  limited  scope  for  their  implementation  at  national  level.  As  a  European 
regulation  the  GDPR  is  binding  in  its  entirety  and  directly  applicable  in  all  Member 
States  pursuant  to  Article  288(2)  sentence  2  TFEU.  The  GDPR  contains  some  saving 
clauses  addressing  the  Member  States  and  enabling  them  to  adopt  national  provisions 


503  Costa-Cabral/Lynskey,  "Family  ties:  the  intersection  between  data  protection  law  and  competition  in  EU  law", 
CMLR  2017,  11  (18). 

504  The  case-law  rightly  considers  e.g.  Section  4(1)  of  the  German  Federal  Data  Protection  Act  (BDSG)  or  Sections 
12,  13  of  the  German  Telemedia  Act  (TMG)  as  “a  statutory  provision  which  is  also  intended  to  regulate  market 
conduct"  within  the  meaning  of  Section  4(1 1 )  of  the  German  Act  Against  Unfair  Competition  (UWG,  old  version, 
now  Section  3a  UWG),  as,  according  to  the  case-law,  the  Federal  Data  Protection  Act  protects  citizens  not  only 
in  their  personal  sphere  as  individuals,  but  also  in  the  same  way  in  their  economic  activities  as  consumers. 
Berlin  Higher  Regional  Court,  decision  of  24  January  2014,  para  158  (juris);  Berlin  Regional  Court,  decision  of 
28  October  2014  (Facebook  Onlinespiele),  file  ref.  1 6  O  60/13,  para  53  (juris). 

505  Rothmann/Buchner,  "Der  typische  Facebook-Nutzer  zwischen  Recht  und  Realitat",  DuD  2018,  p.  342  (346). 

506  Regulation  (EU)  201 6/679  of  the  European  Parliament  and  of  the  Council  of  27  April  201 6  on  the  protection  of 
natural  persons  with  regard  to  the  processing  of  personal  data  and  on  the  free  movement  of  such  data,  and 
repealing  Directive  95/46/EC. 

507  Directive  95/46/EC  of  the  European  Parliament  and  of  the  Council  of  24  October  1995  on  the  protection  of 
individuals  with  regard  to  the  processing  of  personal  data  and  on  the  free  movement  of  such  data. 
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in  individual  cases.508  However,  these  clauses  concern  in  particular  data  protection 
rules  relating  to  the  processing  of  data  for  the  purpose  of  fulfilling  a  legal  obligation  or 
public  tasks;  this  is  to  ensure  that  sector-specific  provisions  remain  possible  in  the 
public  data  protection  law  of  the  Member  States.  These  rules  are  not  relevant  in  the 
present  case.  A  violation  of  data  protection  principles  can  thus  be  investigated  directly 
on  the  basis  of  the  GDPR.509 

532  In  view  of  the  balancing  of  interests  in  a  situation  of  imbalances  of  power,  terms  and 
conditions  that  violate  the  legal  principles  of  data  protection  laws,  and  also  conditions 
that  are  inappropriate  under  the  legal  principles  of  provisions  on  unfair  contract  terms, 
constitute  an  abuse  of  a  dominant  position  under  Section  1 9(1 )  GWB  where  a  sufficient 
degree  of  market  power  is  involved.510  Also,  both  cases  share  similar  characteristics 
due  to  the  fact  that  most  violations  of  data  protection  rules,  as  in  the  case  in  question, 
are  committed  and  accompanied  by  the  use  of  pre-formulated  declarations  of  a 
contracting  party  (see  also  2.  below).  The  practical  options  private  end  consumers  have 
for  becoming  aware  of  the  content  of  the  terms  and  conditions  for  the  collection  of  data 
and  effectively  objecting  to  them  do  not  in  principle  differ  from  the  practical  options 
consumers  have  under  the  legal  provisions  on  unfair  contract  terms.  This  is  a  further 
argument  in  favour  of  treating  the  provisions  applying  to  terms  and  conditions  for  data 
collection  with  regard  to  the  application  of  Section  19  GWB  in  the  same  way  as  was 
already  stipulated  by  the  abovementioned  case-law  of  the  Federal  Court  of  Justice  for 
the  legal  provisions  on  unfair  contract  terms. 

533  The  objections  raised  by  the  parties,  claiming  that  the  provisions  on  unfair  contract 
terms  and  data  protection  law  are  fundamentally  different,  are  not  sustainable. 
According  to  the  parties,  the  differences  are  essentially  based  on  the  fact  that  data 
processing  was  not  subject  to  contractual  freedom  but  had  to  comply  with  data 
protection  legislation,  whereas  the  provisions  on  unfair  contract  terms  merely  limited 
the  scope  of  contractual  freedom.511  This  view  fails  to  recognise  that  data  protection 
law  does  not  make  any  stipulations  about  the  data  processing  procedures  to  be  carried 
out,  but  places  restrictions  on  the  freedom  of  the  responsible  organisation  in  choosing 
possible  data  processing  procedures,  thus  achieving  a  balancing  of  interests  between 
the  various  data  protection  principles  and  the  justifications. 


508  Sydow,  Europaische  Datenschutzgrundverordnung,  2017,  Introduction,  para.  45ff . ;  on  the  legislative  history  see 
Ehmann/Selmayr,  Datenschutzgrundverordnung,  2017,  Art.  6,  para.  30ff. 

509  See  also  Berlin  Higher  Regional  Court  on  the  assessment  under  the  legal  provisions  on  general  terms  and 
conditions:  judgment  of  27  December  2018,  23  U  196/13,  p.  5f.  [...] 

510  [■■■] 

511  [■■■] 
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534  The  Federation  of  German  Consumer  Organisations  (VZBV),  which  was  admitted  to 
the  proceeding  as  a  third  party,  is  right  in  pointing  out  that,  according  to  the  case-law, 
data  policies  also  fulfil  the  elements  of  general  business  terms  because,  from  the 
perspective  of  users,  they  have  a  regulatory  character.512  The  ensuing  question  as  to 
the  appropriateness  of  data  policies  within  the  framework  of  the  test  of  reasonableness 
of  contents  under  Section  307(1)  and  (2)  of  the  German  Civil  Code  (BGB)  is  based  on 
the  provisions  of  the  GDPR  whose  mandatory  principles,  according  to  the  case-law, 
are  directly  applicable  in  this  respect  as  a  concept  of  appropriateness  of  general 
business  terms.513  On  this  basis,  abusive  business  terms  pursuant  to  Section  19(1) 
GWB  could  also  be  examined  in  the  present  case  with  respect  to  a  violation  of  Section 
307  BGB  which  in  turn  refers  to  the  mandatory  principles  of  the  GDPR.  This  would  be 
the  concept  used  by  the  Federal  Court  of  Justice  for  the  application  of  the  legal 
provisions  on  unfair  contract  terms  in  the  VBL-Gegenwert  cases.  It  is  not  evident  why 
the  direct  application  of  the  GDPR’s  principles  within  the  context  of  the  stipulation  of 
Section  1 9(1 )  GWB  should  not  be  covered  by  this  concept  or  even  be  impossible. 

b.  Relationship  between  competition  law  and  data  protection  law 

535  The  application  of  data  protection  principles  in  an  assessment  under  Section  19(1) 
GWB  is  not  inhibited  by  the  European  and  German  data  protection  laws.  The 
Bundeskartellamt’s  decision  is  not  in  violation  of  any  rules  on  competence  and 
consistency  stipulated  by  the  GDPR  (see  (1),  nor  does  the  GDPR  contain  final, 
substantive  provisions  with  respect  to  Section  19  GWB  (see  (2). 

(1)  No  violation  of  the  rules  on  competence  and  consistency 

536  The  application  of  data  protection  principles  in  the  enforcement  of  the  prohibition  of 
abusive  practices  is  first  of  all  not  excluded  because  of  the  fact  that  the  competition 
authority  is  not  a  competent  data  protection  authority  pursuant  to  Sections  55,  56 
GDPR.  Contrary  to  the  view  held  by  Facebook514,  the  Bundeskartellamt  does  not 
operate  to  enforce  data  protection  rules  as  a  national  data  protection  officer,  but  merely 
applies  the  European  law  principles  as  important  indications  for  its  assessment  under 
competition  law  of  whether  the  conduct  of  a  dominant  company  is  appropriate.515  The 

512  Comment  by  the  VZBV  dated  1  January  2019,  p.  13,  [...];  Berlin  Higher  Regional  Court,  judgment  of  27 
December  2018,  23  U  196/13,  judgment,  p.  5,  [...] 

513  Berlin  Higher  Regional  Court,  judgment  of  27  December  2018,  23  U  196/13,  judgment,  p.  5f.  [...] 

514  [■■■] 

515  Cf.  also  the  decision  of  the  Italian  consumer  protection  authority  AGCM,  Bolletino  46/2018  of  10  December 
2018,  p.  22ff. ,  http://www.aacm.it/pubblicazioni/bollettino-settimanale/2018/46/Bollettino-46-2018;  [...]  available 
in  Italian  only  ,  which  states  in  para.  48  (Bundeskartellamt  unofficial  translation):  "And  finally  the  reference  made 
by  FB  to  findings  of  the  Irish  Data  Protection  Commissioner  (I DPC)  following  the  examination  carried  out  from 
2011-2012  is  completely  irrelevant  as  the  IDPC’s  examination  was  carried  out  on  the  basis  of  different  legal 
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Bundeskartellamt  only  considers  itself  competent  to  intervene  under  competition  law 
concerning  companies  which  are  norm  addressees  of  the  German  Competition  Act’s 
prohibitions  of  abusive  practices.  In  no  way  does  the  authority  consider  itself  competent 
to  intervene  under  data  protection  law,  neither  concerning  norm  addressees  of  the 
German  Competition  Act  nor  concerning  any  other  companies  that  are  subject  to  the 
GDPR.  It  is  thus  irrelevant  which  data  protection  authority  is  locally  competent  for  the 
enforcement  of  data  protection  law  as  a  supervisory  authority,  and  whether  or  not  a 
German  authority  could  intervene. 

537  Contrary  to  Facebook’s  opinion,  no  restriction  of  the  enforcement  of  the  prohibition  of 
abusive  practices  based  on  data  protection  law  can  be  seen  to  arise  from  the  GDPR 
provisions  on  cooperation  and  consistency. 

538  According  to  the  GDPR,  in  the  case  of  companies  with  several  establishments  in  the 
EU,  the  supervisory  authority  of  the  main  establishment  is  competent  to  act  as  lead 
supervisory  authority  (Art.  56(1)  GDPR).  The  lead  supervisory  authority  shall  submit  to 
the  other  competent  supervisory  authorities  its  draft  decision  and  give  them  the 
opportunity  to  comment.  If  an  authority  objects  to  this  draft,  the  “consistency 
mechanism”  under  Article  63ff.  GDPR  will  be  initiated.  The  European  Data  Protection 
Board  (a  body  composed  of  the  Member  States’  supervisory  authorities,  Art.  68  GDPR) 
will  adopt  a  binding  decision  pursuant  to  Art.  65(1  a),  (2)  GDPR  by  a  two-thirds  majority 
of  the  members  of  the  Board.  The  lead  supervisory  authority  will  then  have  to  make  the 
final  decision  as  adopted  by  the  Data  Protection  Board.  The  consistency  mechanism 
for  the  cooperation  between  the  supervisory  authorities  is  to  safeguard  the  consistent 
application  of  the  law  and  a  consistent  level  of  protection  in  the  supervision  of  data 
protection.  The  mechanism  is  without  prejudice  to  any  measures  the  Commission  may 
take  in  the  exercise  of  its  powers  under  the  Treaties,  e.g.  bringing  a  matter  before  the 
Court  of  Justice  of  the  European  Union  if  a  Member  State  has  failed  to  fulfil  an 
obligation  under  the  Treaties  (Art.  258  TFEU).516 

539  It  cannot  be  concluded  from  the  consistency  provisions  that  authorities  have  a 
monopoly  on  the  application  and  interpretation  of  data  protection  law.517  The 
consistency  mechanism  is  evidently  restricted  to  the  cooperation  between  the 
European  data  protection  authorities  which  are  to  safeguard  the  uniform  application  of 


norms  (data  protection  rules).  This  means  that  there  are  no  “overlapping  competences”  because  the  respective 
areas  of  competence  are  specific  areas  and  because,  in  the  present  case,  the  authority  [AGCM]  only 
investigated  and  penalised  the  existence  of  unfair  business  practices  ex-post  and  in  application  of  the  Codice 
del  Consumo,  without  contradicting  in  any  way  the  findings  of  the  IDPC.  The  IDPC  also  stated  that  the  solutions 
[chosen  by  Facebook]  had  not  eliminated  all  the  critical  problems  in  respect  of  “user  profiling”  and  that  rapid 
technological  innovation  required  a  permanent  monitoring  of  the  way  in  which  user  data  are  processed.” 

516  Recital  135  GDPR. 

5,7 
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the  law  at  a  uniform  level  of  protection  which  had  not  been  achieved  within  the  EU 
despite  a  previous,  fully  harmonised  data  protection  standard  under  the  Data  Protection 
Directive  95/49/EC518.  The  mechanism  is  thus  to  be  considered  as  a  measure  which 
aims  at  raising  the  level  of  protection,  and  not  at  restricting  the  application  and 
interpretation  of  the  data  protection  law  by  the  European  Data  Protection  Board  and 
thus  restricting  all  enforcement  activities  involved  in  the  protection  of  data  as  a 
fundamental  right.  Neither  will  the  power  of  the  European  Data  Protection  Board  to 
develop  guidelines  be  restricted  by  the  application  of  data  protection  principles  in  an 
incidental  manner  within  the  context  of  competition  law.519 

540  This  can  be  seen  from  the  fact  that  direct  data  protection  law  enforcement  is  not  limited 
to  the  supervisory  authorities;  action  can  be  taken  under  the  civil  law  without  any 
restrictions.  This  applies  to  individuals  whose  fundamental  rights  as  data  subjects  are 
affected  (e.g.  Art.  82  GDPR),  but  also,  in  particular,  to  consumer  protection 
associations  as  well  as  competitors  and  their  associations  which  can  enforce  data 
protection  based  on  stipulations  of  the  Act  against  Unfair  Competition  (UWG)  or 
regulations  on  business  terms  under  the  Civil  Code  linked  to  data  protection  (of.  e.g. 
Section  2(1),  (2)  sentence  1  no.  11,  sentence  2  of  the  German  Act  relating  to  Actions 
for  Injunctions  in  the  case  of  Violations  of  Consumer  Protection  Law  and  other 
Violations,  UKlaG).  Extensive  enforcement  action  has  been  and  will  continue  to  be 
taken.520  Most  of  the  ECJ’s  case-law  that  can  be  found  on  the  already  completely 
harmonised  data  protection  law  based  on  Data  Protection  Directive  95/46/EC  has,  in 
fact,  resulted  from  civil  law  actions.  The  ECJ’s  judgment  on  the  “Safe  Harbour” 
agreement  was  based  on  a  private  action  by  the  Austrian  citizen  Maximilian  Schrems 
who  had  lodged  a  complaint  with  the  Irish  Data  Protection  Commissioner  (hereinafter: 
IDPC)  against  the  transfer  of  his  personal  data  to  the  United  States  and  brought  an 
action  before  the  High  Court.  The  High  Court  referred  the  matter  to  the  ECJ  for  a 
preliminary  ruling.521  The  ECJ’s  judgment  on  the  classification  of  dynamic  IP  addresses 
as  personal  data  within  the  meaning  of  Art.  2  a)  and  Art.  7  f)  Directive  95/46/EC  was 
based  on  an  action  brought  by  Patrick  Breyer  and  a  request  for  a  preliminary  ruling 


518  ECJ,  judgment  of  24  November  201 1 ,  case  C-469/10  and  469/10,  joined  cases  2011,  1-12181-12208,  para.  1 , 
summary. 

519  [■■■] 

520  Cf.  Annual  Report  of  the  Federation  of  German  Consumer  Organisations  (vzbv)  2017/1 8,  p.  61 ;  VZBV/Facebook 
on  account  of  inadmissible  dispatch  of  friend-finder  emails,  Berlin  Higher  Regional  Court  ,  judgment  of  24 
January  2014,  Federal  Court  of  Justice,  judgment  of  14  January  2016,  Ref.  I  ZR  65/14;  VZBV/Facebook  on 
account  of  inadmissible  transfer  of  data  in  the  use  of  online  games  (Berlin  District  Court,  judgment  of  28  October 
2014,  Ref.  16  O  60/13,  Berlin  Higher  Regional  Court,  judgment  of  22  September  2017,  Ref.  5  U  155/14); 
VZBV/Facebook  on  account  of  inadmissible  general  terms  and  conditions  (Berlin  District  Court,  judgment  of  16 
January  2018,  Ref.  16  O  341/15);  see  also  Podszun/deToma,  Die  Durchsetzung  des  Datenschutzes  durch 
Verbraucherrecht,  Lauterkeitsrecht  und  Kartellrecht,  Neue  Juristische  Wochenschrift  (NJW)  2016,  p.  2987ff. 

521  ECJ,  judgment  of  6  October  2015,  Ref.  C-362/14  (Safe  Flarbour). 


157 


submitted  by  the  Federal  Court  of  Justice.522  Currently  a  request  for  a  preliminary  ruling 
has  been  submitted  to  the  ECJ  by  the  Dusseldorf  Higher  Regional  Court  regarding  a 
case  involving  the  question  of  who  is  responsible  under  data  protection  law  for  data 
processing  triggered  by  “Like”  buttons  that  are  integrated  into  third-party  websites.  The 
action  had  been  brought  by  the  VZBV.523 

541  The  substantive  application  of  data  protection  law  through  competition  law  stipulations 
does  not  in  any  way  threaten  the  consistent  interpretation  of  data  protection  law,  but 
rather  promotes  consistency.  Consistent  interpretation  is  achieved  under  civil  law 
through  the  successive  stages  of  appeal  which,  due  to  the  application  of  European  law, 
end  up  before  the  ECJ,  just  as  the  cases  pursued  by  data  protection  authorities.  The 
ECJ  can  be  requested  at  an  early  stage  to  give  a  preliminary  ruling  pursuant  to  Art.  267 
TFEU.  There  is  no  doubt  that  this  type  of  law  enforcement  has  remained  unaffected  by 
the  GDPR.  Furthermore,  the  guidelines  of  the  European  Data  Protection  Board  must 
also  comply  with  the  ECJ’s  case-law. 

542  In  this  respect  the  consistency  mechanism  for  data  protection  law  applicable  to 
supervisory  authorities  is  not  different  from  the  procedure  for  the  coherent  interpretation 
of  the  European  competition  rules  carried  out  by  the  European  Competition  Network 
(ECN).  This  procedure,  which  enables  the  European  Commission  to  initiate  antitrust 
proceedings  for  the  adoption  of  a  decision  pursuant  to  Article  11(6)  of  Regulation 
1/2003,  also  does  not  involve  civil  proceedings  which  undoubtedly  represent  an 
important  pillar  of  competition  law  enforcement  which  is  characterised  by  civil  law 
relationships.  Apart  from  its  competences  under  the  Treaties,  the  European 
Commission  can  participate  in  civil  law  disputes  in  the  area  of  competition  law  as 
amicus  curiae.  In  civil  proceedings  concerning  data  protection  law  cases,  there  are  no 
provisions  for  such  a  participation  either  by  the  European  Data  Protection  Board  or  the 
European  Commission.  The  consistency  mechanism  under  the  GDPR  thus  contributes 
to  safeguarding  the  consistent  application  of  the  law  -  a  contribution  which  ultimately 
remains  below  the  framework  of  possibilities  provided  by  the  ECN. 

543  In  view  of  the  fact  that  Section  19  GWB  is  also  one  of  the  direct  civil  law  prohibitions 
which,  within  the  framework  of  the  generally  required  balancing  of  interests,  must  also 
take  into  account  non-competition  law  principles,  in  particular  mandatory,  higher¬ 
ranking  constitutional  principles  including  data  protection  rules,  it  is  not  evident  why  this 
should  be  treated  differently  than  a  civil  claim  based  on  the  Act  Against  Unfair 
Competition  (UWG)  or  on  stipulations  on  unfair  contract  terms  under  the  Civil  Code 

522  ECJ,  judgment  of  1 9  October  201 6,  Ref.  C-582/1 4. 

523  Dusseldorf  Higher  Regional  Court,  judgment  of  19  January  2017,  Ref.  1-20  U  40/16;  pending  before  the  ECJ 
under  C-40/17. 
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(BGB).  In  particular,  it  is  not  evident  why,  in  view  of  the  consistency  mechanism,  only 
the  competition  authority  should  be  prevented  from  applying  and  interpreting  data 
protection  law  based  on  Section  19  GWB  while  civil  claims  can,  in  fact,  be  brought 
based  on  Section  19  GWB  with  regard  to  data  protection  law.524 

(2)  GDPR  does  not  include  any  final,  substantive  provisions 

544  Data  protection  regulations  do  not  suspend  abuse  control,  which  is  more  specific, 
either.  The  regulations  do  not  include  final  provisions  regarding  dominant  companies, 
i.e.  they  only  allow  data  processing  policies  by  dominant  companies  to  be  examined  by 
data  protection  authorities  based  on  the  direct  data  protection  regulations,  or  the 
existing  enforcement  options  under  civil  law  (UWG  or  legislation  on  business  terms). 
However,  this  does  not  include  an  examination  based  on  the  prohibition  of  abusive 
practices  pursuant  to  Section  19  GWB  which  applies  in  particular  to  dominant 
companies. 

545  Data  processing  has  great  relevance  for  the  competitive  performance  of  a  company. 
The  commercial  use  of  the  personal  data  of  customers,  users  and  third  parties  is  a 
significant  factor  in  competition  (see  above  481  ff.).  Businesses  therefore  strive  to  gain 
as  much  information  as  possible  about  their  (potential)  customers  in  order  to  improve 
their  products,  offer  personalised  services  and  enable  targeted  advertising.  Digital 
technology  has  made  it  possible  to  analyse  particularly  large  amounts  of  data  from 
different  sources  and  formats  as  fast  as  possible.525  Among  other  things,  this  enables 
companies  to  build  customer  and  interest  profiles  which  are  highly  relevant  for  their 
competitive  performance. 

546  Under  the  GWB  it  is  an  essential  task  of  the  Bundeskartellamt  to  monitor  the 
competitive  behaviour  of  dominant  companies  and  put  an  end  to  abusive  practices  that 
have  an  effect  within  the  scope  of  application  of  the  German  Competition  Act  (Section 
185(2)  GWB).  Under  the  national  as  well  as  the  European  legal  framework  there  is  a 
strong  public  interest  in  public  enforcement  of  the  prohibition  of  abuse  of  a  dominant 
position  in  cases  where  the  practices  of  dominant  companies  cause  a  high  degree  of 
harm  and  have  wide-reaching  effects. 

547  It  is  evident  that  the  GDPR  has  neither  called  into  question  the  competence  of 
competition  authorities  nor  the  importance  of  competition  law  when  it  comes  to  the  data 


524  [...] 

525  The  three  terms  volume,  variety,  velocity  are  predominantly  used  to  describe  the  characteristics  of  "big  data". 
They  stem  from  a  research  report  by  Doug  Laney,  analyst  at  Gartner  Consulting;  see  also  Monopolies 
Commission,  Special  Report  on  "Competition  Policy:  The  challenge  of  digital  markets",  2015,  p.  44  with 
further  references. 
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processing  activities  of  a  dominant  company.  This  cannot  be  assumed  to  be  the  case 
as  the  data  protection  law  does  not  include  any  provision  declaring  that  its  rules  are 
exhaustive  (of.  e.g.  Section  111  (1 )  and  (2)  of  the  German  Energy  Industry  Act,  EnWG). 
Also  the  data  protection  authorities  have  acknowledged  the  important  role  of 
competition  law  enforcement  as  a  reaction  to  violations  of  data  protection  rules. 
According  to  the  resolution  of  the  Conference  of  Independent  Data  Protection 
Authorities  of  the  German  Federal  Government  and  the  Lander  (Konferenz  der 
unabhangigen  Datenschutzbehorden  des  Bundes  und  der  Lander),  the  enforcement  of 
data  protection  law  is  not  the  sole  response  to  violations  of  data  protection  rules. 
Competition  and  antitrust  law,  according  to  the  conference,  are  also  applicable  in  this 
respect.  Even  divestiture  is  mentioned  as  an  option  to  punish  the  systematic 
circumvention  of  data  protection  for  the  purpose  of  gaining  anti-competitive  advantages 
in  the  markets.526 

548  In  his  comment  on  the  present  proceeding,  Hamburg’s  Commissioner  for  Data 
Protection  and  Freedom  of  Information  emphasises  the  importance  of  the  prohibition 
of  abusive  practices  under  competition  law  (Bundeskartellamt  unofficial  translation): 
“ Abusive  market  behaviour  which  violates  data  protection  rules  and  leads  to  a  situation 
where  fair  competition  is  no  longer  possible  in  digital  markets,  must  be  stopped.  In  this 
respect,  data  protection  and  competition  law  are  two  sides  of  the  same  coin.  The 
activities  of  the  Bundeskartellamt  strive  to  ensure  that  it  will  no  longer  pay  off  to  violate 
data  protection  rules  in  order  to  gain  market  power.  The  authority  can  be  sure  of  the 
support  of  the  Hamburg  Commissioner  for  Data  Protection  and  Freedom  of 
Information.”527 

549  [...]528 

550  In  line  with  this,  in  Section  18(3a)  GWB  new  version,  the  German  legislator  made 
access  to  such  data  a  stand-alone  criterion  in  the  assessment  of  market  power,  thus 
expressly  emphasizing  the  relevance  of  data  processing  for  competition  law,  and 
pointed  out  its  intention  of  facilitating  abuse  control.529  Particularly  for  those  companies 
which  operate  a  multi-sided  market  or  a  network  within  the  meaning  of  Section  18(3a) 
GWB,  there  is  a  direct  legislative  link  between  their  data  processing  activities  and 
market  power  within  the  meaning  of  the  GWB.  The  market  power  of  a  dominant 

526  Resolution  of  the  Conference  of  Independent  Data  Protection  Authorities  of  the  German  Federal  Government 
and  the  Lander  (Konferenz  der  unabhangigen  Datenschutzbehorden  des  Bundes  und  der  Lander,  DSK)  of  26 
April  2018,  “Facebook-Datenskandal  -  Neues  Europaisches  Datenschutzrecht  bei  Sozialen  Netzwerken 
durchsetzen!“  [...] 

527 

528 

529  Cf.  legislative  intent  on  the  9th  amendment  to  the  GWB  with  regard  to  Section  18(3a)  no.  4,  Bundestag  printed 
paper  no.  1 8/1 0207,  p.  51 . 
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company  with  a  data-driven  digital  business  model  provides  it  with  extended  data 
processing  capabilities  which  the  company  will  have  a  high  incentive  to  use,  in 
particular  with  a  view  to  the  competitive  relevance  of  user  data  for  advertising  funding. 
Also  and  particularly  in  this  area,  abuse  control  plays  a  vital  and  independent  role  which 
the  competition  authorities  fulfils  in  line  with  the  provisions  of  the  GWB. 

551  However,  the  stipulated  control  of  data  processing  policies  cannot  mean  that,  in  its  task 
of  monitoring  the  scope  of  data  processing,  the  competition  authority  should  disregard 
the  principles  of  general  data  protection  law  and  develop  its  own  benchmark  or  other 
tools  instead.  This  is  already  impossible  in  view  of  the  constitutional  duty  of  the 
competition  authority  to  apply  the  general  clauses  in  such  a  way  that  the  higher-ranking 
fundamental  rights  under  the  EU  Charter  and  the  German  Basic  Law  are  taken  into 
account.  The  development  of  other  benchmarks  or  tools  would  ultimately  even 
contravene  the  GDPR’s  efforts  to  safeguard  consistency.  As  shown  by  the  case-law  on 
VBL-Gegenwert,  an  abuse  of  a  dominant  position  can  be  caused  by  the  fact  that  a 
company  did  not  even  comply  with  the  general  legal  framework.  The  control  of  abusive 
practices  with  respect  to  the  scope  for  data  processing  must  therefore  also  include 
compliance  with  data  protection  law. 

552  Furthermore,  the  fact  that  the  GDPR  only  provides  a  general  legal  data  protection 
framework  applicable  in  equal  measure  to  all  the  responsible  parties  does  not  mean 
that  the  market  position  would  be  irrelevant  in  the  assessment  of  its  data  processing 
policies  under  the  GDPR.  In  this  respect,  the  question  of  whether  the  individuals 
concerned  were  forced  to  accept  the  data  processing  terms  due  to  a  lack  of  alternative 
offers  can  play  an  important  role  in  clarifying  whether  consent  was  freely  given  (cf.  Art. 
7(4)  in  conjunction  with  Recital  43  GDPR  which  requires  a  clear  imbalance  between 
the  controller  and  the  data  subject).  Moreover,  the  list  of  other  reasons  justifying 
processing  in  Art.  6  GDPR  includes  the  criterion  of  necessity  and  proportionality  in  view 
of  the  business  purposes  and  legitimate  interests  pursued  by  the  company.  The 
examination  of  these  reasons  must  also  take  into  account  the  market  position  of  the 
data  controller.530 

553  Conversely,  from  the  fact  that  data  protection  law  also  takes  into  account  the 
examination  of  a  dominant  position  it  cannot  be  concluded  that  the  dominant  position 
would  have  to  be  investigated  and  determined  exclusively  by  the  data  protection 
authorities.  Determining  whether  market  dominance  exists  is  a  key  element  of 
competition  law  as  a  part  of  economic  law,  and  the  task  of  a  competition  authority  which 


530  Article  29  Data  Protection  Working  Party,  Opinion  6/2014  on  the  notion  of  legitimate  interests  of  the  data 
controller  under  Article  7  of  Directive  95/46/EC,  available  at  https://ec.eurooa.eu/iustice/article- 
29/documentation/ooinion-recommendation/files/201 4/wp21 7  en.odf  (last  accessed  on  1 0.01 .201 9),  p.  40,  55. 
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has  the  relevant  powers  and  acts  within  a  differentiated  legal  and  coherence 
framework.  Based  on  the  European  legal  and  coherence  framework,  parallel  abuse 
control  by  the  competition  authority  is  necessary  and  will  be  carried  out  in  line  with  the 
data  protection  rules. 

554  It  is  therefore  not  evident  that  the  application  of  national  abuse  control  by  the 
competition  authority  could  be  in  violation  of  the  principle  of  sincere  cooperation  under 
Art.  4(3)  TEU.531  The  rules  on  competence  and  consistency  have  not  called  into 
question  the  competence  of  the  competition  authority,  nor  has  a  final,  substantive 
provision  been  established.  There  is  no  obligation  for  a  competition  authority  not  to 
apply  competition  law  in  order  to  have  the  GDPR  provisions  become  final. 

555  Furthermore,  in  order  to  facilitate  the  application  of  competition  law  in  this  area,  the 
German  legislator  has  paved  the  way  for  cooperation  with  the  German  data  protection 
authorities  by  introducing  Section  50c  GWB.  The  Bundeskartellamt  conducts  the 
proceeding  in  close  coordination  with  the  Flamburg  data  protection  commissioner,  a 
competent  authority  pursuant  to  Art.  55  ff.  GDPR  in  respect  to  Facebook’s  subsidiary 
in  Flamburg.  Contact  has  also  been  made  with  the  Federal  Commissioner  for  Data 
Protection  and  Freedom  of  Information  (Bundesbeauftragter  fur  den  Datenschutz  und 
die  Informationsfreiheit,  BfDI)  who  is  the  joint  representative  on  the  European  Data 
Protection  Board  in  accordance  with  Section  17  of  the  Federal  Data  Protection  Act 
(BDSG),  and  with  the  Belgian  data  protection  authority.[...]532 

556  The  Bundeskartellamt  has  therefore  consulted  the  relevant  data  protection  authorities 
and  none  of  the  authorities  has  objected  to  the  proceeding.  These  consultations 
eliminated  the  threat  of  an  allegedly  imminent  “highly  problematic”  conflict  with  the 
enforcement  efforts  of  the  originally  competent  data  protection  authorities533.  According 
to  the  documents  on  their  discussions  with  the  competent  data  protection  authority 
submitted  by  the  parties  in  response  to  the  Bundeskartellamt’s  decision  requesting 
information,  there  was  no  such  threat. 

557  Finally,  no  concerns  can  be  raised  about  an  alleged  lack  of  expertise  of  the  competition 
authority,  as  referred  to  by  Facebook.  The  Bundeskartellamt  must  take  into  account 
and  apply  the  general  legal  frameworks  applicable  in  each  sector  of  the  economy.  The 
statement  that  the  Bundeskartellamt  had  incorrectly  applied  European  data  protection 


531 

532  [■■■] 
[...] 
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law  and  that  Facebook  had  acted  in  line  with  the  applicable  provisions  of  data  protection 
law,  is  incorrect.534 

558  Furthermore,  the  Bundeskartellamt  refers  to  the  numerous  proceedings  conducted  by 
German  and  European  data  protection  and  consumer  protection  authorities  which,  inter 
alia,  concerned  inadmissible  processing  of  data  from  company-owned  services  or 
Facebook  Business  Tools.  Fiamburg's  Commissioner  for  Data  Protection  and  Freedom 
of  Information  and  also  many  other  European  data  protection  authorities  have 
conducted  proceedings  against  Facebook  on  account  of  the  inadmissible  combination 
of  WhatsApp  data  with  Facebook.com.535  Belgian  and  French  data  protection  officers 
have  conducted  proceedings  against  Facebook  on  account  of  the  inadmissible 
collection  of  data  on  third-party  websites  and  their  combination  with  Facebook  accounts 
on  Facebook.com  by  means  of  identifying  cookies.536  On  the  basis  of  consumer 
protection  law,  the  Italian  competition  authority  AGCM  recently  imposed  a  fine  against 
Facebook  amounting  to  10  million  euros  on  account  of  aggressive  business  practices 
by  violations  of  data  protection  law.537 

2.  Data  processing  terms  as  (other)  contract  terms 

559  The  relevant  provisions  on  the  processing  of  data  collected  from  Facebook-owned 
services  and  Facebook  Business  Tools  in  Facebook's  Terms  of  Service,  Data  Policy, 
Cookies  Policy  and  the  implementation  thereof  are  to  be  classified  as  terms  and 
conditions  within  the  meaning  of  Section  19  GWB. 

560  The  location  of  the  specific  data  processing  intended  and  carried  out  by  the  parties  in 
the  Data  Policy  or  Cookies  Policy  required  for  data  protection  reasons  does  not  mean 
that  the  feature  of  the  business  terms  can  be  superseded  (see  a.).  The  provision  of 
data  does  not  constitute  a  "price"  within  the  meaning  of  the  prohibition  of  anti¬ 
competitive  behaviour  (see  b.). 


534  [...] 

535  Decision  of  the  Hamburg  Commissioner  for  Data  Protection  and  Freedom  of  Information  of  23  September  2016 
(followed  up  by  Hamburg  Administrative  Court,  decision  of  24  April  2017,  Ref.  13  E  5912/16,  and  Hamburg 
Higher  Administrative  Court,  decision  of  26  February  2018,  Ref.  5  Bs  93/17;  Decision  of  the  French  CNIL  of  18 
December  2017,  https://www.cnil.fr/en/data-transfer-whatsapp-facebook-cnil-publiclv-serves-formal-notice- 
lack-leqal-basis  (last  accessed  on  10  January  2019);  Fine  imposed  on  15  March  2018  by  the  Spanish  data 
protection  authority  AEDP,  see  https://www.heise.de/newsticker/meldung/Hoechststrafe-Spanische- 
Datenschuetzer-bitten-Facebook-und-WhatsApp-zur-Kasse-3996469.html  (German  news  report,  last  accessed 
on  10  January  2019). 

536  Recommendation  by  the  Belgian  CBPL  of  16  May  2017, [...].;  judgment  of  the  Brussels  Court  of  First  Instance 
of  16  February  2018,  [...];  fine  proceedings  of  the  French  CNIL,  see  press  release  of  16  May  2017, 
https://www.cnil.fr/en/facebook-sanctioned-several-breaches-french-data-protection-act  (last  accessed  on 
10.01.2019). 

537  AGCM,  Bolletino  46/2018  of  10  December  2018,  p.  22ff.,  http://www.aacm.it/pubblicazioni/bollettino- 
settimanale/201 8/46/Bollettino-46-201 8  ;[...]  (available  in  Italian  only). 
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a.  Data  policies  as  part  of  the  Terms  of  Service 

561  Contrary  to  Facebook's  view,  the  Terms  of  Service  in  conjunction  with  the  Data  Policy 
and  Cookies  Policy  are  indeed  terms  and  conditions  as  defined  by  Section  19  GWB. 
The  explanations  in  the  Data  and  Cookie  Directive  specify  Paragraph  2  of  the  Terms 
of  Use.  The  requirement  of  transparency  under  data  protection  law,  which  obliges  the 
parties  to  provide  information  on  their  data  processing  by  issuing  a  data  policy,  does 
not  alter  the  nature  of  the  business  terms. 

562  The  antitrust  term  “business  term”,  as  used  in  Section  19(1),  (2)  nos.  2  and  3  GWB,  for 
instance,  needs  to  be  interpreted  broadly  in  order  to  make  the  entire  supplier-customer 
relationship,  which  is  characterised  by  an  imbalance  of  power,  subject  to  the  prohibition 
of  abuse  in  addition  to  pricing.538  As  such,  with  regard  to  the  market  quality  of  the 
relationship  between  Facebook  and  the  users  of  Facebook.com  (para.  239ff.  above), 
the  following  needs  to  be  taken  into  consideration,  namely  that  it  can  certainly  be 
assumed  that  a  “business”  relationship  exists. 

563  Business  terms  must  first  include  the  expressly  regulated  terms  and  conditions  which 
customers  must  consent  to  and  which  are  therefore  the  subject  of  the  contractual 
arrangement.  They  include  the  factual  terms  and  conditions  which  are  carried  out 
without  the  customers’  consent.  Business  terms  also  include  any  actual  transactions 
that  may  be  the  subject  matter  of  a  contractual  arrangement.539 

564  Contrary  to  Facebook’s  opinion,540  the  data  processing  procedures  at  issue  are  all  part 
of  the  contractual  arrangement,  since  users  must  agree  to  the  Terms  of  Service  before 
they  can  use  the  service  (see  above  para.  88).  For  the  Terms  of  Service  indicate  the 
following  in  Paragraph  2  under  the  heading  "Our  Data  Policy  and  your  privacy  settings" 
(above  para.  94):  “We  collect  and  use  your  personal  data  in  order  to  provide  the 
services  described  above  to  you.  You  can  learn  about  how  we  collect  and  use  your 
data  in  our  Data  Policy  [hyperlink].  [...]“  This  means  the  Terms  of  Service  themselves 
contain  a  completely  unrestricted  regulation  for  the  processing  of  each  user's  personal 
data  which  users  have  to  agree  to.  According  to  Paragraph  5,  these  terms  make  up  the 
entire  agreement  between  the  users  and  Facebook  Ireland  Limited  regarding  the  use 
of  Facebook  Products.  The  processing  of  personal  data  is  therefore,  according  to 
Facebook’s  own  Terms  of  Service,  expressly  part  of  the  agreement  and  is  therefore 
the  subject  matter  of  the  agreement.  Whether  this  consent  is  deemed  consent  under 


538  cf.  the  concept  of  business  terms  (in  German)  Langen/Bunte-Nothdurft,  Section  19  GWB,  para.  142 

539  Cf.  Bechtold,  GWB,  8th  edition,  Section  19,  para.  53;  Langen/Bunte-Nothdurft,  Section  19  GWB,  para.  142 

540  [  j 
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data  protection  law  and  can  provide  a  sufficient  legal  basis  is  irrelevant  for  the 
contractual  inclusion  of  the  Terms  of  Service  for  data  processing. 

565  The  Data  Policy  is  expressly  referred  to  in  Paragraph  2  and,  together  with  the  Cookies 
Policy,  to  which  the  Data  Policy  refers,  therefore  sets  out  the  concrete  terms  of  use 
with  regard  to  the  processing  of  personal  data.  In  any  case,  the  Data  Policy  and 
Cookies  Policy  have  become  part  of  the  contract  due  to  the  refererence  in  Paragraph 
2  Terms  of  Service  as  they  specify  the  Terms  of  Service  governing  the  processing  of 
personal  data.  In  addition,  the  Data  Policy  and  Cookies  Policy  themselves  have 
regulatory  character  because  from  the  customer's  viewpoint  they  contain  binding 
provisions  that  are  supposed  to  correspond  to  the  conclusion  of  the  contract.541  This 
also  applies  in  view  of  the  fact  that,  under  the  heading  “What  is  our  legal  basis  for 
processing  data?'  the  parties  rely  to  a  large  extent  on  the  fulfilment  of  the  Terms  of 
Service  in  the  Data  Policy  and  invoke  performance  of  the  contract  as  the  legal  basis. 
Yet  the  question  of  the  regulatory  nature  of  the  contract  is  not  determined  by  whether 
or  not  it  is  a  permissible  legal  basis  under  data  protection  law.  This  is  because  from  the 
users'  point  of  view,  which  is  the  only  perspective  relevant  in  this  context,  these 
provisions  lay  down  a  contractual  meaning  if  not  a  contractual  obligation  that  is  imposed 
unilaterally,  just  like  the  rest  of  the  content  of  the  contract. 

566  The  open  wording  of  the  Data  Policy  and  Cookies  Policy  must  therefore  also  be  taken 
into  account  as  part  of  the  contractual  terms.  The  objection  raised  by  the  parties  that 
the  wording  of  the  policies  ensues  from  the  obligation  under  data  protection  law  to 
transmit  the  information  in  a  concise,  transparent,  intelligible  and  easily  accessible 
form,  using  clear  and  plain  language542,  is  not  convincing.  However,  this  open  wording 
is  also  used  in  particular  with  regard  to  the  processing  of  data  from  Facebook-owned 
services  and  Facebook  Business  Tools.  In  this  respect,  the  related  policies  each  use 
the  same  open  stipulation  that  data  is  processed  across  all  Facebook  Products  and 
Companies.  A  limitation  of  the  data  record  and  the  intended  use  can  only  be  found  in 
the  WhatsApp  FAQs. 

567  Additionally,  it  is  therefore  quite  common  to  clarify  in  the  data  policies,  for  instance, 
which  data  is  not  processed  for  what  purposes,  assuming  any  such  restriction  exists  in 
the  first  place.  The  WhatsApp  policy  states  in  one  place  for  instance  that  the  contents 
of  encrypted  messages  are  not  read.  The  alleged  limited  actual  data  processing  which 
is  not  specifically  substantiated  at  any  stage  is  not  reflected  in  Facebook's  Terms  of 
Service.  From  the  user's  perspective,  Facebook's  Data  Policy  and  Cookies  Policy 

541  cf.  judgment  of  Higher  Regional  Court  of  27  December  2018,  23  U  196/13,  copy  of  the  judgment,  p.  5f.,  [...]  For 
this  reason,  they  need  to  be  classified  as  general  terms  and  conditions. 

542  [■■■] 
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therefore  allow  for  virtually  unlimited  data  processing  from  sources  outside  the  social 
network.  The  vagueness  of  the  wording  also  implies  that  Facebook  at  the  very  least 
intends  to  process  data  from  third-party  sources.  The  fact  that  Facebook  uses  a  data- 
driven  business  model  is  common  knowledge  and  is  acknowledged  by  the  company 
itself.  In  this  respect,  extensive  use  of  existing  data  is  economically  expedient  and 
commercially  reasonable  and  is  expected  to  be  predictable  at  least  for  the  future543, 
especially  if  a  contractual  basis  for  it  has  been  created. 

568  The  transparency  requirement  under  data  protection  law  that  obliges  the  data  controller 
to  provide  the  data  subject  with  information  about  data  processing  pursuant  to  Article 
12(1),  Article  13  and  Article  14  GDPR  does  not  mean  the  Data  Policy  and  Cookies 
Policy  cannot  be  classified  as  business  terms.544  This  obligation  does  not  mean  that 
the  policies  would  only  have  purely  informative  character  which  would  exclude  the 
quality  of  contractual  regulation.  General  terms  and  conditions  of  business  are  also 
subject  to  a  transparency  requirement  pursuant  to  Article  307  para.  1  sentence  2  of  the 
German  Civil  Code  (Burgerliches  Gesetzbuch).  The  Bundeskartellamt  takes  into 
account  the  informative  nature  of  the  Data  Policy  and  Cookies  Policy,  including  those 
of  Facebook-owned  services,  to  the  extent  that  they  document  how  data  processing 
terms  are  actually  implemented.  In  that  regard,  contrary  to  the  view  taken  by  the  parties, 
the  actual  processing  of  the  data  is  also  the  focus  of  investigation,  although  it  is  not 
limited  to  that. 

b.  No  price  within  the  meaning  of  antitrust  law 

569  The  possible  fee-like  function  of  providing  data  does  not  mean  that  the  data  processing 
terms  are  to  be  regarded  as  prices  within  the  meaning  of  Section  19(2)  nos.  2  and  3 
GWB. 

570  From  the  company's  point  of  view,  data  processing  has  a  monetisation  and  indirect 
financing  function,  and  data  are  generally  perceived  as  a  kind  of  "currency"  on  the 
Internet.  From  the  Facebook  users'  point  of  view,  however,  the  impression  remains  that 
the  service  is  free  of  charge  and  it  says  precisely  this  in  a  Facebook  advertising  slogan 
("Facebook  is  and  will  remain  free  of  charge").  When  paying  for  a  specific  service, 
consumers  have  a  clear  idea  of  how  much  they  are  spending  and  they  can  influence 
the  costs  they  incur  by  adapting  their  demand  behaviour  according  to  the  limits  of  their 
budget.  When  it  comes  to  handing  over  their  data,  the  situation  is  completely  different. 


543  cf.  for  instance,  Federal  Court  of  Justice  of  8  May  2001,  KVR  12/99,  WuW/E  DE-R  711,  717  -  Ost-Fleisch; 
judgment  of  29  October  1985,  KVR  1/84,  WuW  Federal  Court  of  Justice  221 1 , 2218  -  Morris-Rothmans. 

544  J  ] 
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571  Personal  data  represent  an  unlimited  commodity  that  is  not  used  up  by  sharing  and 
even  consumers  on  a  limited  budget  do  not  need  to  determine  how  much  they  are 
willing  to  pay.  Rather,  the  main  problem  -  similar  to  terms  and  general  terms  and 
conditions  -  is  that  when  consumers  share  their  personal  data,  they  are  not  really  able 
to  judge  which  and  how  many  data  are  being  collected  by  which  company,  to  whom 
their  data  is  being  transmitted  and  what  the  implications  of  giving  consent  to  data 
processing  are.  As  the  investigations  in  the  present  case  show,  the  large  number  of 
conditions  and  provisions  governing  data  processing  regularly  involved  in  the  massive 
use  of  personal  data  means  private  users  are  hardly  aware,  if  not  fully  unaware,  of  the 
individual  provisions,  as  is  typical  of  pre-formulated  general  terms  and  conditions 
dictated  by  the  provider.545 

572  These  characteristics  justify  the  examination  of  inappropriate  agreements  and 
provisions  on  data  processing  by  the  dominant  undertaking  under  the  aspect  of  abusive 
business  terms.  In  addition,  the  new  provisions  of  Section  18(2a)  GWB  state  that  the 
assumption  of  a  market  is  not  invalidated  by  the  fact  that  a  good  or  service  is  provided 
free  of  charge.  Otherwise,  there  would  have  been  no  need  to  clarify  that  a  market  within 
the  meaning  of  the  law  is  still  a  market  even  if  a  service  is  provided  “free  of  charge”. 
According  to  the  explanatory  memorandum,  business  models  such  as  the  one  at  issue 
here  are  precisely  what  provided  the  background  to  the  regulation.546  The  genesis  and 
terminology  of  the  new  regulation  thus  confirm  the  outcome  that  provisions  governing 
data  sharing  are  not  regulations  governing  payment  within  the  meaning  of  Section 
19(1),  (2),  nos.  2  and  3  GWB,  but  rather  contractual  terms. 

3.  Violation  of  GDPR  data  protection  values 

573  The  data  processing  from  other  Facebook-owned  services  and  from  Facebook 
Business  Tools,  which  is  imposed  by  Facebook  and  is  presented  in  detail  in  the 
operative  part  of  the  decision,  breaches  European  data  protection  values  pursuant  to 
GDPR.  For,  the  collection  of  user  and  device-related  data  and  combining  these  data 
by  assigning  them  to  the  respective  Facebook  user  accounts  and  the  use  of  this 
information  actually  involves  the  processing  of  personal  data  including  special  data 
categories  and  profiling  (see  a.).  Facebook  is  responsible  for  the  imposed  processing 
of  personal  data  under  data  protection  law  (see  b.)  There  is  no  sufficient  justification 
pursuant  to  Article  6(1),  Article  9  (2)  GDPR  (see  c.)  for  the  imposed  processing  of  data 
from  Facebook-owned  services  or  Facebook  Business  Tools. 


545  [  ] 

546  Legislative  intent  of  the  9th  Amendment  to  the  German  Competition  Act  2017,  Bundestag  printed  paper 
18/10207,  p.  47f. 
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a.  Processing  of  special  categories  of  personal  data  and  profiling  (Articles  4  and 
9GDPR) 

574  Both  the  user  and  device-related  data  from  other  Facebook-owned  services  and  from 
Facebook  Business  Tools  are  personal  data  within  the  meaning  of  Article  4  GDPR  (see 
(1).  This  includes  special  categories  within  the  meaning  of  Article  9  (1)  GDPR  (see  (2). 
The  "recording",  "combination"  and  "use"  of  the  data  provided  for  and  carried  out  in  the 
Data  Policy  fulfil  the  definition  of  procedures  defined  as  "data  processing"  in  Article  4(2) 
GDPR  and  include  the  "profiling"  defined  as  "data  processing"  in  Article  4(4)  GDPR 
(see  (3). 

(1)  Personal  data 

575  All  user-  and  device-related  data  described  and  actually  processed  in  the  Data  Policy 
comprise  information  relating  to  identified  or  identifiable  natural  persons  pursuant  to 
Article  4  para.  1  GDPR.  According  to  this  provision  an  identifiable  natural  person  is  one 
who  can  be  identified,  directly  or  indirectly,  in  particular  by  reference  to  an  identifier 
such  as  a  name,  an  identification  number,  location  data,  an  online  identifier  or  to  one 
or  more  factors  specific  to  the  physical,  physiological,  genetic,  mental,  economic, 
cultural  or  social  identity  of  that  natural  person. 

576  All  data  that  Facebook  processes  from  its  own  services  or  from  Facebook  Business 
Tools  designated  in  the  operative  part  of  the  decision  therefore  comprise  personal  data 
because  Facebook  can  and  actually  does  assign  them  to  Facebook  user  accounts  and 
combines  this  data  within  the  framework  of  the  social  network.  In  order  to  create  a 
Facebook  account,  users  have  to  provide  at  least  their  first  and  last  name,  their 
birthday,  gender,  mobile  phone  number  or  e-mail  address.  Users  are  given  a  Facebook 
user  ID  when  they  create  a  Facebook  account.  When  using  Facebook.com,  users 
disclose  a  large  amount  of  other  personal  information.  The  data  processed  from  other 
sources  can  be  assigned  to  these  identifying  data,  so  that  each  user-  and  device- 
related  data  can  also  be  classified  as  personal  data. 

577  "User-related  data"  can  be  categorised  as  information  which,  according  to  its  content, 
refers  directly  to  the  person,  such  as  identity,  interests,  living  conditions, 
communication  content  or  the  user's  behaviour.  "Device-related  data"  can  be  defined 
as  technical  data  in  the  broadest  sense  relating  to  the  terminal  devices  used  by  the 
user  as  well  as  to  the  software  and  other  content  stored  on  these  devices.  This  "device- 
related  data"  can  indirectly  reveal  information  about  the  user,  such  as  location-related 
information,  physical  movements  which  are  generated  via  the  positioning  data  or 
mobile  device  sensors,  creating  a  user  movement  profile. 
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578  In  addition,  device-related  information  in  particular  plays  a  very  important  role  for  user 
identification  and  the  individual  assignment  of  data  collected.  This  includes,  for 
instance,  the  unique  device  information  such  as  the  advertising  ID,  MAC  address  or 
the  IMEI  (International  Mobile  Equipment  Identity)  of  the  mobile  device.  Further 
information  on  the  devices  used  by  users,  the  software  installed  on  them  and  technical 
configurations,  including  browser  information,  can  also  be  used  to  identify  the 
respective  users  on  the  basis  of  their  unique  device  configuration.  Facebook  [...]  uses 
metadata  to  assign  the  data  to  Facebook  users.547  This  is  also  indicated  in  the  Cookies 
Policy.  It  says  that  Facebook  uses  other  technologies,  including  data  it  stores  on  users’ 
web  browser  or  device,  identifiers  associated  with  users’  device,  and  other  software, 
for  similar  purposes  as  cookies. 

579  The  device-related  data  collected  in  particular  facilitate  the  process  of  so-called 
"browser  fingerprinting"  or  "device  fingerprinting".  As  such,  a  distinction  is  made 
between  passive  and  active  fingerprinting.  Passive  fingerprinting  involves  the  reading 
of  information  that  is  transmitted  when  a  website  is  accessed  via  the  technical  protocols 
used.  This  includes  the  browser  type,  browser  version,  browser  settings,  IP  address,  if 
applicable  the  manufacturer  and  type  designation  of  the  smartphone,  tablet  or  other 
mobile  device.  Active  fingerprinting  involves  a  program  code  which  is  executed  directly 
on  the  device.  Information  can  be  read  specifically,  for  instance,  via  JavaScript.  This 
allows  a  variety  of  other  pieces  of  device-related  information,  such  as  screen  resolution, 
time  zone,  system  colours,  plugin  versions,  installed  fonts,  languages,  processor  cores, 
window  size  and  much  more  to  be  captured. 

580  The  information  is  stored  on  the  Facebook  server  when  users  visit  the  website,  and  is 
then  captured  again  the  next  time  the  page  is  accessed  and  is  matched  with  the  stored 
data  -  the  fingerprint.  Owing  to  the  large  number  of  individual  users’  setting  options  that 
can  be  customised,  the  fingerprint  allows  the  user  to  be  identified  with  considerable 
accuracy.  A  unique  user  profile  is  created  by  combining  these  different  pieces  of 
information.  The  more  information  there  is  available  and  the  more  individual  the 
settings  are,  the  more  accurately  unambiguous  identification  can  be  achieved.  This 
explains  how  a  user  can  be  identified  even  if  the  fingerprint  has  been  slightly  modified 
in  the  meantime.  According  to  a  scientific  test  conducted  by  Lehigh  University 
Pennsylvania/USA,  users  can  be  identified  with  a  reliability  of  99.24%  via  browser  or 
device  fingerprinting,  without  having  to  resort  to  IP  addresses,  cookies  or  similar 
techniques.548 


547  [...] 

548  https://www.heise.de/newsticker/meldunq/Web-Browser-Finaerprinting-Erkennbar-auch-ohne-Cookie- 

3597078.html  (in  German,  last  accessed  on  1 0  January  2019). 


169 


581  Facebook  also  collects  and  stores  this  identifying  information  when  Facebook.com  is 
used.  The  data  collected  from  other  Facebook-owned  services  and  from  Facebook 
Business  Tools  can  then  be  matched  with  the  data  already  assigned  to  the  Facebook 
user  account  in  question.  There  are  a  number  of  ways  in  which  data  can  be  assigned. 
If  the  data  source  is  a  third-party  website,  a  cookie  set  by  Facebook  containing  the 
Facebook  user  ID  or  other  information  uniquely  associated  with  the  user  can  be 
transmitted  when  the  website  is  accessed.  If  the  website  has  Facebook  Business  T ools 
embedded,  the  user  information  collected  can  be  assigned  by  passive  or  active 
fingerprinting  based  on  the  browser  and  device  information.  This  applies  in  particular 
to  the  tools  executed  by  default  via  JavaScript  SDKs,  which  are  directly  installed  on  the 
respective  (third-party)  app  on  the  terminal  device.  The  Facebook  pixel  is  also  a 
JavaScript  code  that  can  capture  a  large  amount  of  information  about  website  visitors 
and  their  devices. 

582  In  addition,  a  (hashed)  data  record  with  identifying  characteristics  ("identifiers")  can  be 
sent  from  the  website  via  the  pixel  by  way  of  "Advanced  Matching"  if  no  cookie  has 
been  set.  Facebook  also  recommends  the  websites  to  use  "Advanced  Matching",  which 
involves  direct  transmission  of  the  e-mail  address,  telephone  number,  first  name, 
surname,  city,  state,  zip  code,  gender  and  date  of  birth  that  the  website  receives,  for 
instance  when  users  log  in,  register  or  shop  online.  In  this  regard,  Facebook  expressly 
points  out  that  this  allows  more  activity  on  the  website  to  be  matched  with  Facebook 
users,  even  if  no  cookies  have  been  set.549  As  with  the  other  interfaces,  Facebook 
reserves  the  right  to  analyse  the  data  from  third-party  pages/apps  for  "any  purpose, 
including  commercial  purposes"  in  respect  of  the  information  transmitted  about  user 
behaviour  on  the  websites  or  apps  associated  with  the  hashed  data.550 

583  Due  to  the  multitude  of  data  and  the  possibility  of  assigning  data  to  Facebook  user 
accounts  using  a  unique  identification  number,  ID  or  device  fingerprint,  the  data  on  the 
use  of  the  third-party  website  or  app  including  the  various  configuration  data,  therefore 
always  refers  to  a  "specific"  or  "identified"  person  within  the  meaning  of  Article  4  (1) 
GDPR  regardless  of  the  meaning  and  content  of  the  individual  pieces  of  information. 


549  Cf.  https://developers.facebook.com/docs/facebook-pixel/advanced/advanced-matching,  [...] 

550  see  Paragraph  6.1  to  3  of  Facebook  Platform  Policy,  https://developers.facebook.com/policy/:  “Things  you 
should  know:  6.1:  We  can  analyze  your  app,  website,  content,  and  data  for  any  purpose,  including  commercial”, 
6.2:  We  can  monitor  or  collect  data  related  to  your  use  of  SDKs;  6.3:  We  will  use  information  we  receive  from 
you  or  in  connection  with  your  Platform  integration  pursuant  to  our  Data  Policy.  (...).“,  [...] 


170 


(2)  Special  data  categories 

584  The  processing  of  data  collected  from  Facebook-owned  services  and  Facebook 
Business  Tools  imposed  by  Facebook  also  includes  without  distinction  special  data 
categories  pursuant  to  Article  9  (1)  GDPR. 

585  The  special  categories  of  data  within  the  meaning  of  Article  9  (1 )  GDPR  include  all  data 
revealing  racial  or  ethnic  origin,  political  opinions,  religious  or  philosophical  beliefs  or 
trade  union  membership,  as  well  as  genetic  data,  biometric  data,  health  data  or  data 
relating  to  an  individual's  sex  life  or  sexual  orientation. 

586  Contrary  to  Facebook's  view,  it  is  sufficient  for  the  sensitivity  of  data  arising  from  the 
information  collected  for  it  to  qualify  as  a  "special  data  category".  It  cannot  be  assumed 
that  this  information  is  merely  information  from  which  sensitive  information  might  be 
derived  and  that  this  is  not  sufficient  for  it  to  be  classified  as  sensitive  information.551  At 
the  latest  when  the  information  about  the  page  visited  is  assigned  to  a  Facebook  user 
account  do  sensitive  data  arise  as  a  special  data  category,  since  it  can  be  clearly 
assigned  to  a  natural  person.  In  accordance  with  the  wording  of  Article  9  (1)  GDPR,  it 
is  sufficient  for  classification  as  a  special  data  category  that  data  “reveal”  a  certain 
property.  This  does  not  mean  that  the  data  itself  must  reveal  the  characteristic.  It  is 
sufficient  for  the  content  of  the  data  to  at  least  indirectly  reveal  the  mentioned 
characteristic  to  an  average,  objective  third  party.552  The  prohibition  thus  concerns  the 
starting  date  that  can  reveal  the  above-mentioned  characteristics  through  processing 
and,  if  applicable,  interpretation.553 

587  The  collection  of  data  on  third-party  websites  and  apps  can  easily  generate  data  on 
racial  and  ethnic  origin,  political  opinions  or  ideological  convictions.  Through  the  mass 
integration  of  Facebook  Business  Tools  and  APIs  such  as  social  plugins,  Facebook 
Login  or  the  Facebook  pixel,  Facebook  collects  data  that  identify  specific 
characteristics  of  the  user.  The  flirting  app  "Tinder",  for  instance,  offers  a  Facebook 
login  and  the  homosexual  partner  exchange  "Queer"  (www.queer.de)  has  an  integrated 
“Share”  on  Facebook  button.  Even  political  parties  such  as  CDU,  SPD,  Linke  and  AfD 
and  healthcare  websites  such  as  www.onmeda.de  or  www.netdoctor.de  have 
integrated  “Share”  on  Facebook  buttons.  This  enables  Facebook,  which  has  further 


551  [...] 

552  Ehmann/Selmayr,  GDPR,  Art.  9  GDPR,  para.  10  with  further  references;  “Does  Article  9  GDPR  rule  out  the 
permissibility  of  processing  with  big  data?”  (“Schliefit  Art.  9  DSGVO  die  Zulassigkeit  der  Verarbeitung  bei  Big 
Data  aus”?),  ZD  2017,  p.  303  (305). 

553  Schneider,  “SchlielJt  Art.  9  DSGVO  die  Zulassigkeit  der  Verarbeitung  von  Big  Data  aus?“,  ZD  2017,  p.  303 
(304);  Data  Protection  Committee  guidelines  on  automated  case-by-case  decisions  including  profiling  for  the 
purposes  of  Regulation  2016/679  most  recently  amended  and  adopted  on  6  February  2018,  p.  16,  17,  available 
at  http://ec.europa.eu/newsroom/article29/item-detail.cfm7item  id=612053.  (last  accessed  on  1 0  January  201 9) 
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information  about  the  user  based  on  its  existing  data  record,  to  create  detailed  profiles 
also  using  sensitive  user  data. 

588  Contrary  to  Facebook's  view,  this  does  not  involve  objectively  neutral  data  that  only 
become  special  data  categories  if  they  are  combined  with  the  other  data  available  on 
Facebook  but  which,  regardless  of  whether  they  are  combined  or  not,  can  be  inferred 
indirectly  as  sensitive  data.  The  view  of  the  UK  data  protection  authority  ICO 
(Information  Commissioner’s  Office)  which  Facebook  refers  to,  on  the  other  hand, 
deals  only  with  information  that  "may  allow  special  categories  of  personal  data  to  be 
derived  as  a  potential  option".554 

(3)  Data  processing  including  profiling  pursuant  to  Article  (4)  GDPR 

589  After  all,  "recording",  "combining",  and  “using"  means  data  processing  within  the 
meaning  of  Article  4  (2)  GDPR  (see  (a),  which  also  includes  profiling  pursuant  to  Article 
4  (4)  GDPR  (see  (b). 

(a)  Relevant  data  processing  procedures  pursuant  to  Article  4  (2)  GDPR 

590  The  conditions  set  out  in  detail  in  the  operative  part  of  the  decision  and  their 
implementation  relate  to  different  data  processing  procedures  and  phases  within  the 
meaning  of  Article  4  (2)  GDPR,  which  are  summarised  in  the  categories  "recording", 
"combining"  and  "using"  as  the  essential  processing  phases. 

591  Facebook  uses  the  general  terms  of  "recording",  "combining"  and  "using"  in  the 
conditions  at  issue  here.  These  broadly  conceived  terms  facilitate  a  very  wide  range  of 
data  processing  procedures,  each  of  which  fulfils  the  definition  of  data  processing 
pursuant  to  Article  4  (2)  GDPR.  For  Article  4  (2)  GDPR  says  the  generic  term  “data 
processing”  means  any  operation  or  set  of  operations  which  is  performed  on  personal 
data  or  on  sets  of  personal  data,  whether  or  not  by  automated  means.  This  includes 
collection,  recording,  organisation,  structuring,  storage,  adaptation  or  alteration, 
retrieval,  consultation,  use,  disclosure  by  transmission,  dissemination  or  otherwise 
making  available,  alignment  or  combination,  restriction,  erasure  or  destruction. 

592  The  "recording"  of  data  collected  from  other  Facebook  Companies  and  from  Facebook 
Business  Tools  refers  to  the  data  processing  procedures  associated  with  the  receipt  of 
data  from  Facebook  Companies  or  via  Facebook  Business  Tools  from  third  parties  by 
the  operating  company.  At  the  very  least,  it  encompasses  collection,  recording, 
organisation,  structuring,  storage,  adaptation  or  alteration,  retrieval,  consultation  and  if 


554 
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applicable,  also  the  matching  of  the  data,  in  order  to  examine  the  usefulness  of  the 
data.  As  regards  Instagram,  there  is  no  need  for  Facebook. corn’s  operating  company 
to  “receive”  user  and  device-related  data  as  Instagram  is  meanwhile  being  provided  by 
the  same  operating  company. 

593  In  addition,  the  "combining"  of  data  mentioned  in  Facebook's  Terms  of  Service  is  to  be 
construed  within  the  meaning  of  Article  4  (2)  GDPR  as  "combining"  data,  which  includes 
in  particular  assigning  the  available  data  from  the  sources  outside  Facebook.com  to 
the  respective  Facebook  user  accounts  via  the  Facebook  ID.  Matching  data  from  the 
above-mentioned  sources  with  the  existing  data  in  order  to  find  the  Facebook  account 
of  the  respective  user  via  the  various  matching  options  and  assigning  in  particular  the 
Facebook  ID,  is  a  key  procedure  that  represents  the  combining  and  permanent 
combination  of  data. 

594  This  is  based  on  Facebook's  claim  that  the  company  does  not  create  "profiles"  within 
the  meaning  of  individual  data  records,  which  are  each  expanded  by  adding  data.555 
Rather,  based  on  the  current  database  structure,  the  individual  data  are  provided  with 
the  Facebook  ID  after  the  above-mentioned  device-related  data  in  particular  has  been 
matched  such  as  the  so-called  Family  Device  ID  or  other  characteristics  of  the  devices, 
have  been  stored  throughout  the  entire  database  and  are,  if  necessary,  retrieved  for  a 
specific  purpose  during  its  implementation,  depending  on  the  task  of  the  algorithm. 

595  The  "use"  of  the  data  involves  the  use  of  the  data  for  the  purposes  pursued  in  each 
case.  In  this  respect,  Facebook  mentions  a  variety  of  purposes  such  as  the 
personalisation  of  services,  advertisements,  security  purposes  and  research. 
According  to  Facebook's  Terms  of  Service,  "use"  is  defined  as  any  use  of  data  collected 
from  other  Facebook  Companies  and  from  Facebook  Business  Tools  by  the  operating 
company  of  Facebook.com. 

596  Each  of  these  processing  steps  requires  a  legal  basis  pursuant  to  Article  6  (1)  and 
Article  9  GDPR.  The  extension  of  the  catalogue  of  processing  procedures  in  Article  4 
(2)  GDPR  vis-a-vis  Article  2  (b)  Directive  46/95/EC  has  not  brought  about  any  changes 
in  the  legal  situation.  The  definition  of  processing  in  Article  4  (2)  GDPR  also  covers  the 
individual  processing  phases,  which  are  subject  to  a  prohibition  with  reservation  of 
consent.556 


555  [...] 

556  Auernhammer,  GDPR,  Art.  4  para.  18;  Ehmann/Selmayr,  GDPR,  Art.  6,  para.  1. 
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(b)  Profiling,  Article  4  (4)  GDPR 

597  The  use  of  the  data  imposed  consists  of  "profiling"  in  accordance  with  Art.  4  No.  4 
GDPR,  in  particular  with  regard  to  personalisation  and  advertising  purposes.  Facebook 
processes  all  personal  data,  including  data  generated  from  Facebook-owned  services 
and  Facebook  Business  Tools,  by  combining  them  with  the  data  collected  when  the 
social  network  is  used  in  order  to  analyse  or  predict  personal  aspects  relating  to  a 
natural  person.  This  also  includes  aspects  concerning  that  natural  person’s 
performance  at  work,  economic  situation,  health,  personal  preferences,  interests, 
reliability,  behaviour,  location  or  movements.  In  general,  according  to  the  guidelines 
issued  by  the  Article  29  Data  Protection  Working  Party  adopted  by  the  European  Data 
Protection  Board,  profiling  refers  to  the  gathering  of  information  about  an  individual  (or 
group  of  individuals)  and  the  evaluation  of  their  characteristics  or  patterns  of  behaviour 
for  the  purpose  of  dividing  them  into  a  particular  category  or  group,  in  particular  for 
analysis  and/or  forecasting  in  relation  to  their  ability  to  perform  a  task,  interests  or  likely 
behaviour.557  As  such,  the  data  collected  are  also  automatically  analysed  and 
correlations  are  identified  which  are  applied  to  an  individual  for  the  purpose  of 
identifying  characteristics  of  current  or  future  behaviour. 

598  This  demonstrates  that  Facebook  carries  out  detailed  profiling  on  the  basis  of  a  large 
volume  of  data  on  a  variety  of  personal  aspects  for  the  purposes  of  personalising  the 
service  and  for  customising  (targeting)  advertising. 

599  As  indicated  above,  Facebook's  News  Feed  in  particular  is  created  and  individualised 
using  a  relevance  algorithm.  News  Feed  is  a  personalised  stream  of  content  and 
activities  relating  to  the  user.  For  an  optimum  user  experience,  the  aim  is  for  users  to 
see  content  most  relevant  to  them  when  News  Feed  is  displayed.  The  algorithm 
calculates  individually  for  each  individual  user  in  particular  on  the  basis  of  the 
influencing  factors  "Affinity",  "Weight"  and  "Expiry"  a  value  for  any  post  for  the  News 
Feed  that  has  a  positive  or  negative  impact  on  the  supposed  relevance  of  a  post.  This 
is  the  basis  on  which  the  contents  of  each  user’s  personal  News  Feed  is  sorted. 
“Affinity”  is  determined  based  on  interaction  with  the  respective  users  and  their  posts. 
Indicators  include  contact  in  the  form  of  posts  to  the  chronicle,  pages  liked,  comments, 
mutual  tags,  visits  to  websites,  etc.  Overlapping  user  interests,  friends  and  action 
patterns  are  also  relevant.  The  basis  of  the  "Weight"  assessment  is  the  interaction  of 
others  (friends  or  third  parties)  with  the  post  in  the  form  of  clicks,  like  tags,  shared 
content,  comments  and  even  the  contents  of  the  interactions.  Personal  factors  such  as 


557  cf.  Guidelines  on  automated  decisions  in  individual  cases  including  profiling  for  the  purposes  of  Regulation 
2016/679  of  3  October  2017,  most  recently  amended  and  adopted  on  6  February  2018,  p.  7;  [...] 
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the  relevance  of  the  individuals  who  interacted  with  the  post  play  a  role  as  well  as  the 
click/likes/share  quotas.  It  is  also  taken  into  account  for  the  expiry  period,  however, 
whether  a  post  is  only  interesting  in  the  present  situation  or  whether  it  will  continue  to 
be  relevant  in  the  long  term.  This  is  assessed,  for  instance  by  looking  at  the  reaction  to 
the  post  (short-term  and  intensive  or  long-term  and  constant).  The  type  of  content  is 
also  important,  e.g.  whether  the  post  consists  of  an  image,  video,  text,  link,  etc.  If  users 
can  be  observed  to  react  intensively  to  images,  but  rarely  click  on  links,  images  seem 
to  be  more  interesting  to  them  and  will  be  ranked  higher. 

600  Facebook  also  performs  profiling  for  the  purposes  of  targeted  advertising.  In  the 
advertising  manager,  as  described  above,  target  groups  are  formed  on  the  basis  of 
detailed  personal  characteristics  and  preferences  according  to  location,  age,  gender 
and  language  as  well  as  according  to  further  demographic  data,  interests  and 
behaviour,  evaluating  the  user  data.  The  location  can  be  further  specified  based  on  the 
following  criteria:  “Everyone  in  this  location”,  “People  who  live  in  this  location”,  “People 
recently  in  this  location”,  “People  travelling  in  this  location”.  Age  can  be  specified  by 
exact  age  categories,  with  13  being  the  minimum  age  and  65+  being  the  highest  age 
category.  The  following  subcategories  are  available  for  demographic  data:  “Education", 
“Financial”,  “Generation”,  “Home”,  “Life  Events”,  “Parents”,  “Politics",  ..Relationship”. 
“Interests”  are  further  specified  as  “Business  and  Industry”,  “Shopping  and  fashion”, 
“Food  and  drink”,  “Family  and  relationships”,  “Fitness  and  wellness”,  “Hobbies  and 
activities”,  “Sports  and  outdoors”,  “Technology”,  and  “Entertainment”.  “Behaviours”  are 
categorised  as  “Automotive”,  “Digital  activities”,  “Financial”,  “Anniversary”,  “Purchase 
behaviour”,  “Consumer  classification”,  “Multicultural  affinity”,  “Mobile  device  user”, 
“Travel”,  “Residential  profiles”,  “Seasonal  and  events”,  “Home  owners”,  etc.  Tailor- 
made  target  groups  are  put  together,  including  "lookalike"  target  groups,  for  which 
certain  detailed  aspects  are  again  decisive. 

601  It  is  also  expressly  stated  in  the  Facebook  Data  Policy  that  data  collected  from  other 
Facebook-owned  services  and  Facebook  Business  Tools  may  be  used  for  the 
purposes  of  profiling  and  may  be  assigned  to  the  respective  Facebook  accounts  when 
data  are  combined.  It  says  that  the  information  obtained  from  these  sources  is  used  to 
personalise  features  and  content  and  make  suggestions  for  users  on  and  off  the 
Facebook  Products  (e.g.  groups  or  events  users  may  be  interested  in  or  topics  they 
may  wish  to  follow).  Facebook  states  that  it  uses  the  connections,  preferences, 
interests  and  activities  to  create  personalised  products  that  are  unique  and  relevant  to 
users.  Based  on  the  data  it  collects  on  them  and  others  including  any  data  with  special 
protections  they  choose  to  provide  to  which  they  have  given  their  explicit  consent  and 
“how  they  use  and  interact  with  the  Facebook  Products,  and  the  people,  places  or 
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things  they  are  connected  to  and  interested  in  on  and  off  the  Facebook  Products. In 
relation  to  "Information  across  different  Facebook  Products  and  devices"  Facebook 
explains:  “We  connect  information  about  your  activities  on  different  Facebook  Products 
and  devices  to  provide  a  more  tailored  and  consistent  experience  on  all  Facebook 
Products  that  you  use,  wherever  you  use  them.  For  example,  we  can  suggest  that  you 
join  a  group  on  Facebook  that  includes  people  you  follow  on  Instag  ram  or  communicate 
with  using  Messenger....”558  Facebook  also  indicates  in  relation  to  ads  that  it  uses  “the 
information  we  have  about  you”  -  including  information  about  “your  interests,  actions 
and  connections”  -  to  select  and  personalise  ads. 

602  In  this  respect,  Facebook's  Terms  of  Service  and  Data  Policy  do  not  make  any 
distinction  whatsoever  between  the  individual  sources  of  data  even  with  regard  to  the 
purpose  of  personalisation.  According  to  this  information,  the  Facebook  Products 
include  Facebook  (including  the  Facebook  mobile  app  and  in-app  browser), 
Messenger,  Instagram  (including  apps  like  Direct  and  Boomerang),  tbh,  Moments, 
Bonfire,  Facebook  Mentions,  AR  Studio,  Audience  Network,  and  any  other  features, 
apps,  technologies,  software,  products,  or  services  offered  by  Facebook  Inc.  or 
Facebook  Ireland  Limited.  The  Facebook  Products  also  include  Facebook  Business 
Tools  such  as  plugins  (for  example  “Like”  and  “Share”  buttons)  and  the  SDKs  and  APIs, 
used  by  website  owners  and  publishers,  app  developers,  business  partners  (including 
advertisers)  and  their  customers  to  support  business  services  and  share  information 
with  Facebook. 

603  In  addition,  the  "Facebook  Companies"  are  mentioned  without  distinction,  including 
Facebook  Payments  Inc.,  Onavo,  Oculus,  WhatsApp,  Masquerade  and  CrowdTangle. 
Facebook’s  Data  Policy  states  “that  it  processes  information  about  users  across  the 
Facebook  Companies  to  provide  an  innovative,  relevant,  consistent  and  safe 
experience  across  all  Facebook  Company  Products”. 

604  The  Bundeskartellamt  assumes  that  the  information  collected  by  WhatsApp  is  not 
currently  being  used  for  profiling  purposes  on  Facebook.  However,  Facebook's  Terms 
of  Service  do  not  seem  to  contain  any  limitation  similar  to  that  outlined  in  WhatsApp 
FAQs  regarding  WhatsApp  data  and  any  information  can  only  be  found  via  several  links 
to  WhatsApp’s  Help  Centre.  It  must  therefore  be  assumed  that  Facebook  continues  to 
reserve  this  right  vis-a-vis  Facebook  users  and  that  this  is  also  the  subject  matter  of 
the  contractual  terms. 


558  cf.  Facebook’s  Data  Policy  of  19  April  2018  under  heading  II.  “How  do  we  use  this  information”?  [...] 
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b.  Responsibility  for  data  processing 

605  Facebook  and  Facebook  Ireland  Ltd.  are  "responsible"  under  data  protection  law  for 
the  processing  of  data  generated  from  Facebook-owned  services  and  Facebook 
Business  Tools  described  in  detail  above  (Article  4  (7)  GDPR)  and  are  therefore 
responsible  for  compliance  with  the  principles  governing  the  processing  of  personal 
data  (Article  5(2)  GDPR),  as  Facebook  alone  or  jointly  with  others  decides  why  and 
how  personal  data  are  processed. 

606  Facebook  cannot  invoke  group  privileges  (see  (1 ))  for  the  processing  of  data  generated 
from  Facebook-owned  services  WhatsApp,  Oculus,  Masquerade,  and  Instagram 
services,  or  any  other  Facebook-owned  services  for  that  matter. 

607  Facebook  is  at  the  very  least  jointly  responsible  for  the  processing  of  data  generated 
from  access  to  third-party  services  via  Business  Tools  and  other  interfaces  (Articles  24 
and  26  GDPR).  This  does  not  involve  processing  of  data  on  behalf  of  the  controller 
within  the  meaning  of  Article  4(8)  GDPR  as  far  as  individual  services  are  concerned 
(see  (2)). 

(1)  Group  privilege  does  not  apply 

608  With  regard  to  the  processing  of  data  collected  by  other  Facebook  Companies  for  their 
services,  such  as  WhatsApp,  Oculus,  and  Masquerade  in  particular,  the  company 
operating  Facebook.com  in  Europe  -  Facebook  Ireland  Ltd.  -  has  a  separate 
responsibility  under  data  protection  law  for  the  transfer  of  personal  data  of  users 
resident  in  Germany  and  their  assignment  to  the  respective  Facebook  user  accounts 
as  well  as  for  the  further  use  and  other  processing  of  the  data  for  the  purposes  of 
Facebook.com.  These  data  processing  procedures  are  also  subject  in  each  case  to  the 
data  protection  principles  including  the  lawfulness  of  processing  pursuant  to  Article  6(1 ) 
GDPR.  Facebook  cannot  therefore  invoke  any  justification  for  data  processing  by 
Facebook  Companies. 

609  On  the  contrary,  Facebook  Companies  are  deemed  to  be  separate  responsible  entities. 
This  ensues  from  Article  4(7)  GDPR,  according  to  which  the  legal  person  is  regarded 
as  the  responsible  party,  so  that  the  respective  companies  belonging  to  the  group 
remain  responsible  for  data  processing  and  are  therefore  to  be  regarded  as  third  parties 
in  relation  to  each  other.  The  GDPR  does  not  make  any  provision  for  group  privileges. 
The  exchange  of  data  between  companies  belonging  to  the  same  group  is  therefore 
not  permitted  just  because  the  companies  involved  are  affiliated.  Each  company  must 
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continue  to  be  regarded  as  a  separate  entity  under  data  protection  law,  with  the  result 
that  data  transfers  within  the  group  must  also  be  justified  in  each  case.559 

610  The  GDPR  does  define  a  term  “group  of  undertakings”  in  Article  4(19)  GDPR. 
According  to  Recital  48,  controllers  that  are  part  of  a  group  of  undertakings  or 
institutions  affiliated  to  a  central  body  may  have  a  legitimate  interest  in  transmitting 
personal  data  within  the  group  of  undertakings  for  “internal  administrative  purposes”, 
including  the  processing  of  clients'  or  employees'  personal  data.  However,  Recital  48 
itself  does  not  provide  a  legal  basis  for  the  transmission  of  data.  On  the  contrary,  this 
regulation  refers  to  the  balancing  of  interests  in  the  assessment  of  the  lawfulness  of 
data  processing,  as  it  needs  to  be  carried  out  in  particular  pursuant  to  Article  6(1) 
sentence  If)  GDPR.560  This  shows  that  even  data  flows  within  group  undertakings 
require  justification  and  the  companies  must  be  regarded  as  third  parties  vis-a-vis  one 
another  in  each  case. 

611  This  means  each  company  belonging  to  the  Facebook  Group  is  responsible  for  the 
processing  of  personal  data.  This  is  also  justified  from  the  users'  perspective,  since 
some  users  of  a  service  provided  by  a  company  belonging  to  the  Facebook  Group  may 
not  even  be  aware  that  the  service  is  part  of  the  Group.  Furthermore,  the  possibility  of 
combining  different  data  sources  enables  the  processed  data  to  achieve  a  different 
data  quality,  which  also  means  a  different  quality  of  invasion  into  the  privacy  of  the 
individual  and  therefore  requires  independent  justification. 

612  Contrary  to  Facebook’s  view561,  no  group  privilege  can  be  derived  from  Section  36(2) 
GWB  in  this  particular  case.  Even  though  Section  1 9  GWB  provides  the  legal  basis  for 
the  assessment,  the  proportionality  of  data  processing  depends  first  and  foremost  on 
the  principles  governing  data  protection  law.  However,  Section  36(2)  GWB  has  no 
bearing  on  the  question  of  the  proportionality  and  admissibility  of  data  processing  under 
data  protection  law. 

613  The  judgment  handed  down  by  the  Federal  Court  of  Justice  in  the  Entega  case562 
cannot  be  transferred  to  this  particular  case  either.  The  proceedings  instituted  against 
Entega  for  abusive  pricing  specifically  involved  a  price  split  pursuant  to  Section  19(2) 
no.  3  GWB  (Section  19(4)  no.  3  GWB  old).  Here,  too,  the  very  fact  that  pricing  can  be 
strategically  aligned  by  companies  belonging  to  the  group  shows  that  they  should  be 
considered  to  be  a  single  entity.  Section  19(2)  no.  3  GWB  would  be  meaningless  if 


559  Plath,  GDPR,  Article.  6  GDPR,  para.  77 

560  Voigt,  ’’Konzerninterner  Datentransfer  -  Praxisanleitung  zur  Schaffung  eines  Konzernprivilegs",  (available  in 
German  only)  CR  2017,  428  (429). 

561 

562  [...]  Federal  Court  of  Justice,  judgment  dated  7  December  2010,  “Entega“,  KZR  4/10,  para.  17  (iuris). 
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Section  36(2)  GWB  did  not  apply  since  the  dominant  company  could  arbitrarily  use 
legally  independent  subsidiaries  to  enforce  the  price  split.563  No  group  privilege  was 
assumed  here  either.  Moreover,  intra-group  transactions  are  not  generally  exempt  from 
abuse  control  if  they  have  restrictive  effects  on  competition.  This  applies,  for  instance 
to  the  classic  cases  of  bundling  products  within  the  same  group  resulting  in  the  transfer 
of  market  power  or  exploitation  of  the  opposite  side  of  the  market.564  Facebook's  view 
that  group  privileges  are  recognised  fully  and  unanimously  in  antitrust  law565,  is 
therefore  incorrect. 

614  This  means  that  in  view  of  the  Facebook  Group’s  current  structure,  it  is  assumed  that 
Facebook  Ireland  Ltd.  has  an  independent  data  protection  responsibility  for  the 
recording,  combining  and  use  of  user  and  device-related  data  by  WhatsApp  Ireland 
Ltd.  and  WhatsApp  Inc.,  Masquerade  Technologies  Inc.  and  Oculus  VR,  LLC. 
respectively,  with  the  accounts  of  the  online  services  Facebook.com  operated  by 
Facebook  Ireland  Ltd.  at  Facebook  Ireland  Ltd. 

615  This  also  means  that  Facebook  Ireland  Ltd.  was  responsible  for  each  assignment  of 
user  and  device-related  data  from  the  previous  operating  company  Instagram  Inc.  to 
the  user  accounts  held  at  Facebook  Ireland  Ltd.  for  Facebook.com,  including  the 
transfer  of  the  Instagram  service  to  Facebook  Ireland  Ltd.  on  25  May  2018  and  that  it 
required  justification  under  data  protection  law  for  all  data  processing. 

616  For  a  start,  the  merger  of  the  Facebook.com  and  Instagram  services  under  the 
operating  company  Facebook  Ireland  Ltd.  means  that  Facebook  Ireland  Ltd.  is  now 
solely  responsible  under  data  protection  law  for  the  processing  of  personal  data  of  both 
Facebook  users  and  Instagram  users.  The  merger  does  not  mean  that  combining  user 
and  device-related  data  by  Facebook.com  and  Instagram  as  well  as  the  use  of  this  data 
are  no  longer  subject  to  the  lawfulness  requirements  of  the  GDPR.  The  only  difference 
between  it  and  combining  data  from  other  companies  that  are  part  of  the  Group  is  the 
additional  transfer  and  receipt  process,  which  is  described  in  this  context  by  the  term 
"recording",  because  Instagram's  operating  company  already  records  the  relevant  user 
and  device-related  data  when  Instagram  is  used.  Both  the  combination  of  Instagram 
user  data  and  device-related  data  with  the  data  of  users  registered  under  the  Facebook 
account  ("combining"),  as  well  as  their  combined  use  by  the  operating  company  of  the 
services  are  subject  to  a  GDPR  assessment. 


563  Munich  Commentary  on  European  and  German  Competition  Law,  2nd  edition,  Section  19  GWB,  para.  133 

564  cf.  for  instance  Langen/Bunte-Nothdurft,  Section  19  GWB,  para.  355 

565  [  ] 
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(2)  No  effective  processing  on  behalf  of  the  controller 

617  Facebook  also  has  at  the  very  least  joint  responsibility  for  the  processing  of  data  from 
the  Facebook  Business  Tools  described  in  detail  in  the  operative  part  of  the  decision 
(Articles  24  and  26  GDPR).  Facebook  cannot  invoke  data  processing  on  behalf  of  the 
controller  within  the  meaning  of  Article  4  no.  8  or  Article  28  GDPR  with  regard  to  data 
processing,  in  particular  for  measuring  the  effect  of  advertisements  and  Facebook 
Analytics  on  the  use  of  the  Facebook  pixel,  SDKs  or  other  interfaces. 

618  Facebook  is  -[...]566  -at  the  very  least  jointly  responsible  with  the  third-party  providers 
within  the  meaning  of  Article  4  no.  7  and  Article  26  GDPR567  because  Facebook 
determines  the  purposes  and  means  of  processing  at  least  jointly  with  the  third-party 
providers.  The  data  collected  from  Facebook  Business  Tools  only  become  relevant 
when  they  are  assigned  to  Facebook  user  accounts.  In  addition,  the  assignment  to 
Facebook  user  accounts  leads  to  further  data  processing  procedures  on  Facebook 
(storing,  combining,  organising,  using),  which  the  third-party  providers  themselves  are 
unable  to  keep  track  of.  It  therefore  cannot  be  assumed  that  the  third-party  providers 
are  solely  responsible  for  this  essential  part  of  the  data  processing.568  Facebook  does 
not  dispute  its  own  responsibility  for  data  processing  for  the  most  part  either. 

619  Contrary  to  the  opinion  of  the  parties,569  Facebook  cannot  invoke  “data  processing  on 
behalf  of  the  controller”570  within  the  meaning  of  Article  4  no.  8,  28  GDPR  as  far  as 
measuring  the  effect  of  ads  and  Facebook  Analytics  via  the  use  of  the  Facebook  pixel, 
SDKs  or  other  interfaces  is  concerned. 

620  Pursuant  to  Article  4  no.  8  GDPR,  “processor”  means  a  natural  or  legal  person  (...), 
which  processes  personal  data  on  behalf  of  the  controller.  This  relationship  is  regulated 
in  more  detail  in  Article  28  GDPR.  Data  processing  on  behalf  of  the  controller  is 
characterised  by  the  fact  that  a  client  outsources  data  processing,  which  he  would 
otherwise  have  had  to  carry  out  himself,  to  a  body  bound  by  instructions,  whereby  the 


566  [  ] 

567 

568  This  corresponds  to  the  case  law  of  the  European  Court  of  Justice,  judgment  handed  down  on  5  June  2018 
("Fan  page”), case  C-210/16,  para.  26,  27.,  according  to  which  ‘‘the  ‘‘controller”  in  Article  2  d)  of  Directive 
95/64/EC  needs  to  be  broadly  defined.  This  ensues  from  the  fact  that  the  Directive  seeks  to  ensure  a  high  level 
of  protection  of  the  fundamental  freedoms  of  natural  persons,  in  particular  their  privacy,  with  regard  to  the 
processing  of  personal  data;  this  was  also  the  opinion  of  Advocate-General  Bobek  of  19  December  2018,  case 
C-40/17,  para.  65.  Since  Recital  9  of  the  GDPR  says  objectives  and  principles  of  Directive  95/46/EC  are  to 
remain  sound,  these  considerations  can  also  be  extended  the  term  "controller”  within  the  meaning  of  the  GDPR. 

569  [  ] 

570  S.  Sydow,  General  Data  Protection  Regulation  2017,  Article  28,  para.  11 
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client  bears  full  responsibility  under  data  protection  law  for  the  lawful  handling  of 
personal  data  in  external  relations.571 

621  On  this  basis,  transferring  the  role  of  the  solely  responsible  data  processor  in  the 
"Facebook  Business  Tools  Terms"  572  to  the  third-party  companies  does  not  constitute 
effective  processing  on  behalf  of  the  controller. 

622  Paragraph  5  of  Facebook  Business  Tools  Terms  says  “To  the  extent  the  Customer 
Data  contain  personal  data  which  you  process  subject  to  the  (...)  GDPR,  the  parties 
acknowledge  and  agree  that  for  purposes  of  providing  matching,  measurement,  and 
analytics  services  described  in  Paragraphs  2.a.i  and  2.a.ii  above,  that  you  are  the  data 
controller  in  respect  of  such  personal  data,  and  you  have  instructed  Facebook  Ireland 
Limited  to  process  such  personal  data  on  your  behalf  as  your  data  processor  pursuant 
to  these  terms  and  Facebook’s  Data  Processing  Terms,  which  are  incorporated  herein 
by  reference”. 

623  Paragraphs  2.a.i,  2.a.ii  and  2.a.v.  read  as  follows: 

“2.  Use  of  Customer  Data 

We  will  use  Customer  Data  for  the  following  purposes  depending  on  which  Facebook  Company 
Products  you  choose  to  use: 

i.  Contact  information  for  matching 

1.  You  instruct  us  to  process  the  Contact  Information  solely  to  match  the  Contact  Information 
against  Facebook's  or  Instagram's  user  IDs  ("Matched  user  IDs”),  as  well  as  to  combine 
those  user  IDs  with  corresponding  Event  Data.  We  will  delete  Contact  Information  following 
the  matching  process. 

ii.  Event  Data  for  measurement  and  analytics  services 

1.  You  instruct  us  to  process  Event  Data:  (a)  to  prepare  reports  on  your  behalf  on  the  impact 
of  your  advertising  campaigns  and  other  online  content  ("Campaign  Reports")  and  (b)  to 
generate  analytics  and  insights  about  your  customers  and  their  use  of  your  apps,  websites, 
products  and  services  ("Analytics"). 

2.  (...) 

624  These  regulations  do  not  fulfil  the  requirements  regarding  processing  of  data  on  behalf 
of  the  controller  being  governed  by  a  contract  pursuant  to  Article  28  GDPR.  Flere,  the 
processing  of  data  on  behalf  of  the  controller  is  justified  by  future  processors  using 
standard  clauses  that  are  unilaterally  imposed  by  the  alleged  controller. 

625  As  such,  it  is  doubtful  whether  standard  contractual  clauses  imposed  unilaterally  can 
even  be  regarded  as  a  permissible  form  of  contract  under  the  GDPR.  Pursuant  to 
Article  28(6)  to  (8)  GDPR,  admissible  standard  contractual  clauses  are  defined  either 
by  the  Commission  or  by  the  European  Data  Protection  Board.  Recital  81  says  the 


571  [...] 

572  Facebook  Business  Tools  terms,  item  5. a,  B  [...] 
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controller  and  processor  may  choose  to  use  an  individual  contract  or  standard 
contractual  clauses. 

626  Regardless  of  this,  the  unilateral  definition  of  processing  on  behalf  of  the  controller  and 
the  conditions  imposed  by  Facebook  are  not  compatible  with  the  processing  of  those 
data  except  on  instructions  from  the  controller  pursuant  to  Article  29  GDPR.  This  means 
the  data  processor  and  any  person  subordinate  to  the  processor  who  has  access  to 
personal  data  may  process  any  such  data  only  on  the  instructions  of  the  controller.  This 
is  contradicted  by  a  unilateral  specification  defined  by  Facebook  in  Paragraph  5,  2.a.i 
and  2.a.ii  of  the  Facebook  Business  Tools  Terms  which  stipulate  the  limits  within  which 
the  users  of  Facebook  Business  Tools  are  to  issue  instructions.  The  terms  do  not  give 
those  users  the  right  to  issue  instructions.  Instead,  these  third-party  providers  are 
instructed  by  Facebook. 

627  In  addition,  the  data  recorded  through  the  use  of  the  Facebook  pixel,  SDKs  or  other 
interfaces  on  third-party  websites  are  not  used  by  Facebook  solely  to  provide 
aggregated  analysis  to  third-party  companies,  but  are  used  for  Facebook's  own 
commercial  purposes.  In  accordance  with  Paragraph  (2)  of  Facebook  Business  Tools 
Terms,  customer  data  are  also  used  to  personalise  features  and  content  on  Facebook, 
to  improve  Facebook  Products  and  to  promote  the  safety  and  security  of  these 
products.  [...]573  Data  processors  can  certainly  pursue  their  own  interests. 
Nevertheless,  the  processing  must  be  carried  out  at  the  instruction  of  the  controller, 
who  alone  also  determines  the  purposes  of  data  processing.574  Pursuant  to  Article 
28(1 0)  GDPR,  if  a  processor  infringes  this  Regulation  by  determining  the  purposes  and 
means  of  processing,  the  processor  is  considered  to  be  a  controller  in  respect  of  that 
processing. 

628  Facebook  therefore  does  not  play  the  role  of  a  subordinate  processor  in  the  agreed 
relationship  with  the  third-party  providers  which  does  not  have  its  own  decision-making 
scope  with  regard  to  the  purposes  of  data  processing.  It  therefore  cannot  be  compared 
to  service  providers  such  as  letter  shops  or  call  centres.575  Facebook  does  not  act  like 
an  “extended  arm”  for  third-party  providers576  and  its  activities  are  not  limited  to  merely 


573  [...] 

574  Auernhammer,  GDPR/Federal  Data  Protection  Act  (Bundesdatenschutzgesetz,  BDSG),  Article  28  GDPR, 
para.  1 1 

575  The  Data  Protection  Conference  cites  these  examples  as  services  in  the  form  of  processing  on  behalf  of  the 
controller,  see  Data  Protection  Conference;  short  paper  no.  13,  status  16  January  2018,  p.4,  accessible  at 
https://datenschutz-  hamburq.de/paqes/kurzpapiere-dsqvo/  (last  accessed  on  1 0  January  201 9). 

576  see  Bayreuth  Administrative  Court,  judgment  handed  down  on  8  May  2018,  ref.  B  1  p.  28.105,  para.  50  (juris) 
in  relation  to  Facebook  Custom  Audiences. 
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providing  technical  support.577  As  the  provider  of  Facebook  Business  Tools,  Facebook 
itself  determines  the  purposes  for  which  the  collected  data  is  used.  Third-party 
companies  that  integrate  the  tools  cannot  instruct  Facebook  that  the  data  can  only  be 
used  for  the  preparation  of  analyses  and  not  also  for  Facebook  commercial  purposes. 
Third-party  companies  do  not  have  any  insight  into  what  actually  happens  to  the  data 
uploaded  or  transmitted  either.  They  receive  aggregated  measurement  analyses  and 
statistics  as  the  "end  product",  yet  on  the  basis  of  the  contract  they  have  no  influence 
on  how  Facebook  has  processed  the  data  in  the  meantime,  for  instance  to  what  extent 
the  data  is  assigned  to  Facebook  user  accounts  and  what  additional  information 
Facebook  receives  by  comparing  user  behaviour. 

c.  No  justification  under  Article  6  and  Article  9  GDPR 

629  The  processing  of  data  collected  from  Facebook-owned  services  and  Facebook 
Business  Tools  imposed,  described  in  detail  in  the  operative  part  of  the  decision,  is  not 
justified. 

630  Facebook  invokes  all  data  protection  legal  bases  provided  for  in  the  GDPR  (see  (1)) 
for  the  data  processing  procedures  imposed.  Facebook  cannot  invoke  the  user  consent 
it  is  asserting  pursuant  to  Article  6(1  a),  Article  9(2a)  GDPR  (see  (2)).  Data  processing 
is  not  necessary  for  the  performance  of  the  contract  pursuant  to  Article  6(1  b),  Article 
9(2b)  GDPR  either  (see  (3)).  Finally,  data  processing  is  not  justified  by  any  overriding 
interests  of  Facebook  or  third-party  providers  vis-a-vis  the  interests  and  rights  of  the 
data  subject  pursuant  to  Article  6  (1  f)  GDPR  (see  (4)). 

(1)  Legal  bases  invoked 

631  In  Facebook’s  Data  Policy,  Facebook  declares  the  following  under  the  heading  "What 
is  our  legal  basis  for  processing  data?: 

“We  collect,  use  and  share  the  data  that  we  have  in  the  ways  described  above: 

•  as  necessary  to  fulfil  our  Facebook  Terms  of  Service  or  Instagram  Terms  of  Use; 

•  consistent  with  your  consent,  which  you  may  revoke  at  any  time  through  the  Facebook 
settings  and  Instagram  settings; 

•  as  necessary  to  comply  with  our  legal  obligations; 

•  to  protect  your  vital  interests,  or  those  of  others; 

•  as  necessary  in  the  public  interest  and 


577  Bayreuth  Administrative  Court,  loc.  cit.  with  reference  to  Dusseldorf  Higher  Regional  Court,  judgment  handed 
down  on  13  February  2015,  ref.  no.  I  16  U  41/14,  para.  36  (collection  service  but  not  data  processing  on  behalf 
of  the  controller). 
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•  as  necessary  for  our  (or  others')  legitimate  interests,  including  our  interests  in  providing  an 
innovative,  personalised,  safe  and  profitable  service  to  our  users  and  partners,  unless  those 
interests  are  overridden  by  your  interests  or  fundamental  rights  and  freedoms  that  require 
protection  of  personal  data”. 

632  Facebook  therefore  invokes  all  six  available  legal  bases  set  forth  in  Article  6  (1  a)  to  f) 
GDPR  as  well  as  Article  9(2)  GDPR  to  justify  data  processing. 

633  A  hyperlink  ("Learn  more  about  these  legal  bases. . .”)  takes  the  reader  to  another  more 
detailed  document,  in  which  Facebook  provides  further  explanations  for  the  legal 
bases.578  In  particular,  three  of  the  legal  bases  are  mentioned  and  explained  here:  the 
processing  as  necessary  for  the  performance  of  the  contract.  (Article  6(1  b)  GDPR), 
consent  (Article  6(1  a)  and  Article  9  (2a)  GDPR),  and  the  legitimate  interests  pursued 
by  the  controller  or  by  a  third  party,  except  where  such  interests  are  overridden  by  the 
interests  or  fundamental  rights  and  freedoms  of  the  data  subject  (Article  6(1  f)  GDPR). 
Furthermore  reference  is  made  to  the  legal  basis  pursuant  to  Article  6(1  c  to  e)  GDPR. 
Facebook  points  out  that  when  it  processes  users’  data  as  necessary  for  a  task  carried 
out  in  the  public  interest,  users  have  the  right  to  object  to,  and  seek  restriction  of,  its 
processing. 

634  On  this  basis,  with  respect  to  all  persons  who  have  the  legal  capacity  to  enter  into  an 
enforceable  contract,  Facebook  initially  invokes  the  processing  of  data  "to  the  extent 
necessary  for  the  performance  of  the  contracts  (Facebook  Terms  of  Service  and 
Instagram  Terms  of  Service)".  The  most  important  data  uses  for  the  provision  of 
contractual  services  are  the  “provision,  personalisation,  and  enhancement  of  our 
Facebook  Products".  “To  promote  safety,  integrity  and  security”  “To  transfer,  transmit, 
store  or  process  your  data  outside  the  EEA,  including  to  within  the  United  States  and 
other  countries"  to  "To  communicate  with  users,  for  example,  on  product-related 
issues"  and  "To  provide  a  consistent  and  seamless  experiences  across  the  Facebook 
Company  Products”  are  also  mentioned. 

635  In  addition,  Facebook  invokes  users'  consent  for,  among  other  things,  the  processing 
of  data  with  special  protection  for  sharing  with  selected  individuals  and  personalising 
content,  the  use  of  face  recognition  technology,  but  also  for  the  use  of  data  provided 
by  advertisers  and  other  Facebook  partners  regarding  the  user's  activity  outside 
Facebook  Company  Products,  so  that  Facebook  can  personalise  the  advertisements 
shown  to  the  user  on  Facebook  Company  Products  and  on  websites,  apps  and  devices 
that  use  Facebook  advertising  services. 


578  Cf.  https://www.facebook.com/business/learn/how-business-manaaer-works/auide  .  [...] 
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636  Facebook  initially  invokes  overriding  legitimate  interests  in  relation  to  people  under  the 
age  of  majority  who  have  a  limited  ability  to  enter  into  an  enforceable  contract  and 
whose  data  on  Facebook  cannot  be  processed  on  the  grounds  of  necessity  for 
performance  of  the  contract.  In  this  case,  Facebook  claims,  the  provision, 
personalisation  and  improvement  of  Facebook  Products,  the  promotion  of  protection, 
integrity  and  security,  the  provision  of  non-marketing  communications  were  legitimate 
interests,  although  Facebook  specifically  targeted  people  under  the  age  of  majority. 

637  Facebook  also  asserts  legitimate  interests  with  respect  to  all  individuals  and  their  data 
for  the  provision  of  measurements,  analytics  and  other  business  services  when 
Facebook  processes  data  as  the  data  controller.  Facebook  highlights  the  provision  of 
accurate  and  reliable  reporting  to  its  advertisers,  developers  and  other  partners,  to 
ensure  accurate  pricing  and  statistics  on  performance  and  to  demonstrate  the  value 
that  its  partners  realise  using  Facebook  Company  Products  and  in  the  interests  of 
advertisers,  developers  and  other  partners  to  help  them  understand  their  customers 
and  improve  their  businesses,  validate  Facebook  pricing  models  and  evaluate  the 
effectiveness  of  their  online  content  and  advertising  on  and  off  the  Facebook  Company 
Products. 

638  It  also  refers  to  marketing  communications,  research  and  innovation,  social  purposes, 
sharing  information  with  others  and  responding  to  legal  requests  as  legitimate  interests. 
The  latter  help  to  prevent  and  address  fraud,  unauthorised  use  of  the  Facebook 
Company  Products,  breaches  of  Facebook’s  terms  and  policies,  or  other  harmful  or 
illegal  activity.579 

(2)  No  effective  consent 

639  Users  do  not  give  their  effective  consent  within  the  meaning  of  Article  6(1  a),  Article 
9(2a)  GDPR  to  the  processing  of  personal  data  pursuant  to  Facebook's  Data  Policy  in 
respect  of  processing  of  data  collected  from  Facebook-owned  services  and  Facebook 
Business  Tools. 

640  The  consent  that  needs  to  be  given  to  Facebook  when  users  sign  up  with  the  social 
network  is  not  to  be  regarded  as  voluntary  consent  within  the  meaning  of  Article  6(1  a) 
GDPR  (see  (a)).  In  relation  to  the  special  data  categories  covered  by  data  processing 
pursuant  to  Article  9  (1 )  GDPR,  no  explicit  consent  is  given  within  the  meaning  of  Article 
9(2a)  GDPR  (see  (b)).  Even  the  disable  (opt-out)  options  provided  for  in  Facebook's 
privacy  settings  and  the  reference  made  in  the  Cookies  Policy  to  the  browser's  or  user's 
device  settings  do  not  constitute  a  form  of  voluntary  consent  to  the  processing  of  data 


579  [■■■] 
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from  Facebook-owned  services  and  Facebook  Business  Tools,  their  assignment  to 
Facebook  user  accounts  or  use  of  this  data,  in  particular,  for  personalised  ads  (see 

(c)). 

(a)  Agreeing  to  the  Terms  of  Service  does  not  constitute  consent 

641  Agreeing  to  the  Terms  of  Service  which  users  are  required  to  do  in  order  to  be  able  to 
use  the  social  network  does  not  constitute  voluntary  consent  pursuant  to  Article  6(1  a) 
GDPR. 

642  Facebook's  explanation  in  the  amended  Terms  of  Service  and  Data  Policy  shows  that 
-  since  the  GDPR  came  into  force  in  May  201 8  -  Facebook  still  makes  use  of  the  social 
network  dependent  on  users  “agreeing”  to  the  Terms  of  Service  by  clicking  on  the 
"Register"  button.  Flowever,  Facebook  no  longer  invokes  the  users'  consent  which 
needs  to  be  obtained  during  the  registration  process  as  the  legal  basis  under  data 
protection  law  for  all  data  processing  procedures.580  Consent  is  only  mentioned  as  the 
legal  basis  for  data  protection  in  the  Data  Policy  and  in  the  legal  bases  -  as  described 
above  -  for  certain  data  processing  procedures  and  is  obtained  in  a  number  of  ways. 
In  addition,  Facebook  refers  to  legal  justifications.581  Facebook  justifies  this  by  claiming 
it  has  checked  the  extent  to  which  it  relied  in  the  past  on  consent  to  data  processing 
within  the  framework  of  the  transposition  of  the  GDPR.  Yet  Facebook  only  came  to  the 
conclusion  in  certain  cases  that  consent  under  the  GDPR  was  the  most  suitable  legal 
basis.  In  other  cases,  however,  Facebook  says  different  legal  bases,  in  particular  the 
legal  basis  enshrined  in  Article  6(1  b)  GDPR,  were  more  suitable  for  justifying  its  data 
processing  practices.582 

643  Nevertheless,  Facebook  claims  that  users  voluntarily  consent  to  the  service  provided 
by  Facebook  within  the  meaning  of  data  protection  law.583  As  a  precautionary  measure, 
the  Bundeskartellamt  therefore  points  out  that  it  cannot  be  assumed  that  individuals 
give  their  consent  voluntarily  since  users  are  forced  to  consent  to  data  processing  terms 
when  they  sign  up  for  a  service  provided  by  a  company  that  has  a  dominant  position  in 
the  market.584 

644  An  essential  basis  for  lawful  and  appropriate  data  processing  is  that  data  subjects  have 
given  their  consent  voluntarily  (Article  6(1  a)  GDPR,  Article  7  a)  of  the  Data  Protection 


580  [  ] 

581  [...],  https://de-de.facebook.com/about/privacv/update  (last  accessed  on  10  January  2019),  [...];  Facebook, 
“Legal  Bases",  https://www.facebook.com/about/privacv/leaal  bases  (last  accessed  on  10  January  2019),  [...] 

582 

583  [...] 

584 
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Directive  95/46/EC).  This  principle  of  voluntariness  is  a  core  element  of  data  protection 
law,  which  can  be  derived  from  Article  8  of  the  Charter  of  Fundamental  Rights.  If 
consent  is  not  given  voluntarily,  it  is  ineffective.  Otherwise  the  right  to  data  protection 
would  be  undermined.585  Consent  must  fulfil  the  conditions  of  Article  7  GDPR  and 
Article  7  a)  of  the  Data  Protection  Directive  95/46/EC.  It  is  important  for  the  concept  of 
"voluntariness"  according  to  Article  2  h)  of  the  current  Data  Protection  Directive 
95/46/EC  that  the  data  subjects'  consent  is  freely  given  to  their  data  being  processed 
in  the  context  at  hand  and  in  full  knowledge  of  the  facts.  Article  4  (11)  of  the  GDPR 
says  that  “consent”  of  the  data  subject  means  any  freely  given,  specific,  informed  and 
unambiguous  indication  of  the  data  subject’s  wishes  by  which  he  or  she,  by  a  statement 
or  by  a  clear  affirmative  action,  signifies  agreement  to  the  processing  of  personal  data 
relating  to  him  or  her. 

645  Furthermore,  in  the  case  of  consent  being  freely  given  (voluntary  consent),  pursuant  to 
Article  7  (4)  GDPR,  it  must  be  taken  into  account  whether  the  prohibition  of  making 
provision  of  a  service  conditional  on  data  subjects  giving  their  consent  to  processing  of 
their  personal  data  has  been  observed.  For  it  says  that  when  assessing  whether 
consent  is  freely  given,  utmost  account  shall  be  taken  of  whether,  inter  alia,  the 
performance  of  a  contract,  including  the  provision  of  a  service,  is  conditional  on  consent 
to  the  processing  of  personal  data  that  is  not  necessary  for  the  performance  of  that 
contract.  Making  the  provision  of  service  conditional  on  consent  to  the  processing  of 
data,  according  to  Recital  43,  would  eliminate  consent  being  freely  given  if  there  was  a 
"clear  imbalance"  between  the  data  subject  and  the  organisation.  Furthermore, 
according  to  Recitals  42  and  43  of  the  GDPR,  consent  should  not  be  regarded  as  freely 
given  if  the  data  subject  has  no  genuine  or  free  choice  or  is  unable  to  refuse  or  withdraw 
consent  without  detriment. 

646  As  far  as  the  consent  obtained  upon  registration  is  concerned,  there  is  no  real  or  free 
choice  within  the  meaning  of  the  above-mentioned  Recitals  of  the  GDPR.  As  such,  it 
can  remain  open  whether  consent  can  generally  no  longer  be  regarded  as  being  freely 
given  if  it  is  required  for  the  provision  of  service.586  In  any  case,  Facebook's  dominant 
market  position  creates  a  "clear  imbalance"  vis-a-vis  users.  As  outlined  above, 
Facebook  has  a  quasi-monopolistic  position  on  the  market  for  social  networks  vis-a-vis 
users  with  a  user  share  of  more  than  90  percent,  with  the  monopolisation  trend 
continuing.  The  direct  network  effects  prevent  users  from  switching  to  other  services, 


585  Ehmann/Selmayer,  General  Data  Protection  Regulation,  2017,  Article  7,  para.  45 

586  see  Article  29  Data  Protection  Working  Party,  Guidelines  on  consent  under  Regulation  2016/679  of  28 
November  2017,  p.  8ff.;  of.,  for  instance,  Harting,  General  Data  Protection  Regulation,  para.  396f. 
Ehmann/Selmayer,  General  Data  Protection  Regulation,  2017,  Article  7,  para.  53. 
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so  it  cannot  be  assumed  that  users  have  a  free  choice  within  the  meaning  of  data 
protection  law.  Deciding  not  to  use  Facebook  would  have  considerable  disadvantages 
for  users  because  they  would  no  longer  be  able  to  fulfil  their  need  to  participate  in  the 
social  network. 

(b)  No  explicit  consent  for  special  data  categories 

647  However,  effective  consent  cannot  be  deemed  to  be  given  in  the  present  case  also  due 
to  the  lack  of  explicit  (voluntary)  consent  to  the  processing  of  special  data  categories 
pursuant  to  Article  9  (1)  a)  GDPR  within  the  framework  of  the  "profiling"  carried  out  by 
Facebook,  insofar  as  any  such  user  data  are  collected  from  Facebook-owned  services 
and  from  Facebook  Business  Tools  and  are  subsequently  assigned  to  Facebook  user 
accounts. 

648  Facebook  obtains  explicit  consent  only  with  respect  to  those  specific  categories  of  data 
that  users  have  provided  voluntarily  in  their  Facebook  profile  under  the  headings  "Life 
Events"  or  "Interests”.587  Users  can  object  to  face  recognition  which  was  introduced  in 
the  spring.  In  this  case,  Facebook  does  not  match  photos  and  videos  with  the  users' 
profile  photo  or  other  photos  and  videos  on  which  users  have  been  tagged. 

649  Whether  or  not  explicit  voluntary  consent  has  been  given  with  regard  to  this  information 
provided  on  the  social  network  is  debatable. 

650  In  any  event,  no  explicit  and  voluntary  consent  pursuant  to  Article  9(2a)  GDPR  has 
been  given  with  regard  to  the  imposed  collection  of  special  data  categories  from 
Facebook-owned  services  and  Facebook  Business  Tools,  the  combination  of  any  such 
data  by  assigning  them  to  Facebook  user  accounts  or  to  the  use  of  any  such  data.  In 
this  regard,  Facebook  -  as  outlined  above  -  is  wrongly  of  the  opinion  that  this  does  not 
involve  special  data  categories  within  the  meaning  of  Article  9(1)  GDPR. 

(c)  Privacy  settings  and  browser  settings  do  not  constitute  consent 

651  Finally,  the  limited  options  available  in  Facebook's  ad  settings  (see  i.)  and  the  reference 
made  to  browser  and  device  settings  used  to  block  cookies  or  ad  IDs  on  mobile  devices 
(see  ii.)  do  not  constitute  voluntary  consent  to  the  recording  of  data  from  Facebook- 


587  cf.  Facebook  Data  Policy,  “What  is  our  Legal  Basis  for  processing  data?",  https ://de- 
de.facebook.com/about/privacv/update,  [...];  Facebook,  “Legal  Bases", 

https://www.facebook.com/about/privacv/leqal  bases,  [...]  If  the  users  click  the  link  "data  with  special 
protections",  they  are  taken  to  the  heading  "What  kinds  of  information  do  we  collect?"  in  the  Data  Policy.  Here 
it  says  in  relation  to  “Data  with  special  protections”:  “You  can  choose  to  provide  information  in  your  Facebook 
profile  fields  or  “life  events”  about  your  religious  views,  political  views,  your  health  or  who  you  are  "interested 
in”.  This  and  other  information  (such  as  racial  or  ethnic  origin,  philosophical  beliefs  or  trade  union  membership) 
is  subject  to  special  protections  under  EU  law”,  [...] 
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owned  services  and  Facebook  Business  Tools  or  to  the  combination  of  this  data  with 
Facebook  user  accounts. 


i.  Settings  for  personalised  advertising 


652  The  options  available  in  Facebook  ad  settings  do  not  mean  voluntary  consent  justifies 
the  collection  of  data  from  Facebook  Business  Tools  or  the  combination  of  this  data 
with  Facebook  user  accounts. 


653  Facebook  users  can 
control  their  "ad 
preferences”  in  their  “Ad 
settings”.588  Flowever, 
these  control  options  only 
apply  to  the  display  of  ads. 

Among  other  things,  users  have  the  option  to  also  see  ads  "on  the  basis  of  partner 
data". 


n  data  from  partners 

)anv  Products 


Ads  that  include  your  social  actions 


654  If  users  decide  not  to  have  ads  displayed  on  the  basis  of  partner  data,  ads  that  are  no 
longer  based  on  the  partner  data  will  continue  to  be  displayed.  Opting  out  of  various 
settings  does  not  affect  the  collection  of  data  from  Facebook  Business  Tools  or  prevent 
any  such  data  being  combined  with  Facebook  user  accounts.  In  this  respect,  users 
have  no  control  mechanisms  whatsoever.589  They  have  no  way  of  controlling  what  data 
is  recorded  or  combined  with  data  from  other  Facebook-owned  services. 


655  Even  though  the  user's  consent  to  the  display  of  advertisements  based  on  partner  data 
is  now  structured  in  the  form  of  an  "opt-in",  this  does  not  constitute  voluntary  consent 
to  the  processing  of  data  by  combining  it  with  Facebook  user  accounts  or  to  using  this 
data  for  all  other  purposes  of  the  social  network.  The  opt-out  possibility  only  prevents 
personalised  ads  from  being  displayed,  but  it  does  not  prevent  all  other  data  processing 
procedures,  namely  data  recording,  data  matching,  combination  and  linking,  storage, 
organisation,  etc.,  all  of  which  take  place  anyway.  This  also  ensues  from  the  legal 
bases  described  above  which  Facebook  invokes.  It  says  that  consent  “...for  using  data 
that  advertisers  and  other  partners  provide  us  with  about  your  activity  off  Facebook 
Company  Products,  so  we  can  personalise  ads  that  we  show  you  on  Facebook 
Company  Products,  and  on  websites,  apps  and  devices  that  use  our  advertising 
services...”  In  Facebook’s  own  words,  consent  therefore  does  not  cover  the  term 
"recording",  which  describes  all  data  processing  procedures  that  do  not  consist  of  use 


588  Screenshot  at  https://www.facebook.com/ads/preferences/7entry  product=ad  settings  screen  (last  accessed 
on  8  January  2019),  [...] 

589  [  ] 
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for  advertising  purposes.  Facebook  itself  only  invokes  (all)  legal  justifications  in  this 
respect.  Users  can  only  influence  one  purpose  in  relation  to  use  of  their  data. 
Conversely,  consent  to  use  of  data  for  advertising  purposes  cannot  be  construed  as 
consent  to  the  collection  and  combination  of  data.  This  is  because  users  giving  their 
consent  have  the  impression  that  the  data  is  already  available  on  Facebook  and  will  be 
used  for  other  purposes. 

ii.  Blocking  of  cookies  and  advertising  IDs 

656  The  ability  to  block  cookies  in  the  browser  or  disable  ad  tracking  on  mobile  devices 
does  not  constitute  voluntary  consent  to  all  data  processing  procedures  regarding  the 
recording,  combination  and  use  of  data  collected  from  Facebook-owned  services  and 
Facebook  Business  Tools  and  assigned  to  Facebook  user  accounts  either.  Incidentally, 
it  is  not  clear  to  what  extent  Facebook  is  actually  invoking  consent  in  this  respect.  In 
connection  with  consent,  the  above  comments  on  the  legal  bases  also  mention  “For 
collecting  information  that  you  allow  us  to  receive  through  the  device-based  settings 
you  enable  ...”.  The  Cookies  Policy  does  not  make  any  reference  to  the  legal  basis. 
Regardless  of  this,  sufficient  consent  is  not  evident  here  either. 

657  Facebook  sets  various  cookies  on  the  users'  computer  the  first  time  they  visit  the  social 
network  before  they  register,  when  they  use  a  web  browser.  Cookies  regularly  contain 
information  that  allows  users  to  be  tracked  online.  The  browser  also  connects  to 
Facebook  any  time  users  visit  websites  with  their  browser,  and  transmits  user  and 
device-related  information  as  well  as  information  about  the  website.  The  first  time  users 
visit  a  Facebook  page,  a  so-called  cookie  banner  is  displayed,  which  refers  to  the 
cookie  setting  for  the  processing  purposes  Facebook  specified  in  its  Data  Policy  and 
which  users  agree  to  by  further  scrolling  or  navigating  on  the  page.  The  cookie  banner 
also  contains  a  reference  to  the  Cookies  Policy  to  which  users  are  directed  via  a 
hyperlink. 

658  The  last  paragraph  of  the  Cookies  Policy  says  under  the  heading  “Browser  cookie 
controls”  that  the  browser  or  device  may  offer  settings  that  allow  users  to  choose 
whether  to  set  browser  cookies  or  to  delete  them.  The  Cookies  Policy  refers  to  the  help 
functions  of  the  browser  or  the  device.  Facebook  also  points  out  in  this  paragraph  of 
the  Cookies  Policy  that  certain  parts  of  the  Facebook  Products  may  not  work  properly 
if  users  have  disabled  browser  cookie  use. 
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659  However,  in  the  vast  majority  of  cases,  the  Facebook.com  social  network  is  not 
accessed  via  a  web  browser,  but  with  the  mobile  app  on  a  mobile  device.  Mobile 
cookies  have  not  been  used  for  some  time  now  and  users  are  identified  by  means  of 
other  "identifiers".  In  its  Data  Policy,  Facebook  indicates  that  it  uses  these  kind  of 
identifiers  in  order  to  obtain  information  about  users.590  This  means  users  and  their 
devices  can  be  tracked,  inter  alia,  via  the  advertising  ID  assigned  to  the  mobile  device 
when  using  the  apps  installed  on  the  device  and 

^  Datenschutz  Werbung 

when  interacting  online  with  the  device.  The 
advertising  ID  is,  as  shown,  a  unique  identifier 
alongside  other  device  IDs.  However,  unlike  the 
fixed  MAC  address  or  the  IEMI,  users  can  choose 
settings  regarding  the  use  of  the  advertising  IDs 
and  "reset"  the  advertising  ID  at  the  level  of  the 
operating  system  of  the  mobile  device.  This 
means  the  advertising  ID  is  replaced  by  a  new, 
randomly  selected,  unique  number.591 

660  Neither  the  ability  to  disable  cookies  in  browser  settings  nor  the  settings  on  the  mobile 
device  can  provide  the  basis  for  voluntary  consent  to  the  comprehensive  collection  of 
data  from  Facebook-owned  services  and  Facebook  Business  Tools,  the  combination 
of  this  data  to  Facebook  user  accounts,  or  the  use  of  this  data. 

661  The  currently  applicable  Directive  2002/58/EC  (“e-Privacy  Directive”)  indicates  in 
Article  5  (3)  that  the  storage  of  information  or  access  to  information  is  only  allowed  on 
condition  that  the  subscriber  or  user  concerned  is  provided  with  clear  and 
comprehensive  information  pursuant  to  Directive  95/46/EC,  inter  alia  about  the 
purposes  of  the  processing,  and  is  offered  the  right  to  refuse  such  processing  by  the 
data  controller.592  It  is  therefore  questionable  whether  it  is  sufficient  for  consent  to  the 
setting  of  cookies  that  users  are  made  aware  of  the  possibility  of  choosing  browser 
settings  that  define  standards  for  the  permission  of  cookies.  In  this  respect,  Recital  32 
sentence  2  GDPR  approves  the  selection  of  technical  settings  as  a  means  of  consent. 


ALLE  WERBEANBIETER 
Kein  Ad-Tracking 

Ad-ID  zurucksetzen . 


C 


Du  kannst  dich  entscheiden,  keine  auf  deinen 
Interessen  basierenden  Anzeigen  zu  erhalten. 
Moglicherweise  wird  dir  genauso  viel  Werbung 
wie  bisher  angezeigt,  die  jedoch  weniger  relevant 
sein  wird. 


590  Data  Policy,  “What  kinds  of  information  do  we  collect?11  (...)  Identifiers:  Unique  identifiers,  device  IDs  and  other 
identifiers,  such  as  from  games,  apps  or  accounts  that  you  use,  and  Family  Device  IDs  (or  other  identifiers 
unique  to  Facebook  Company  Products  associated  with  the  same  device  or  account)”,  [...] 

591  cf.  also  https://www.checked4vou.de/app  tracking  deaktivieren: 

https://mobilsicher.de/hinterarund/smartphone-nutzer-sollten-ietzt-ihre-werbe-id-aendern  (in  German,  last 
accessed  on  1 0  January  201 9). 

592  Directive  2002/58/EC  of  the  European  Parliament  and  of  the  Council  of  12  July  2002  concerning  the 
processing  of  personal  data  and  the  protection  of  privacy  in  the  electronic  communications  sector  (Directive  on 
privacy  and  electronic  communications),  Official  Journal  no.  L  201  of  31  July  2002  p.  37  -  47. 
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However,  voluntary  (freely  given)  consent  according  to  the  GDPR  requires  an  "Opt-in" 
configuration.  Yet  no  such  “Opt-in”  configuration  is  available  here. 

662  For  cookies  are  set  the  first  time  users  visit  a  Facebook  page  unless  they  leave  it  again 
immediately.  Users  must  then  delete  the  cookies  after  visiting  a  Facebook  page  for  the 
first  time,  using  the  option  to  disable  the  cookies  via  their  device  or  browser  settings. 
At  best,  this  represents  an  opt-out  function,  although  Facebook  does  not  offer  an  actual 
opt-out  function,  but  instead  refers  to  other  services. 

663  Even  if  consent  could  be  considered  to  have  been  given  to  the  setting  of  cookies  by 
not  selecting  the  blocking  options,  this  consent  cannot  extend  to  comprehensive 
recording  of  data  from  Facebook-owned  services  and  Facebook  Business  Tools  via 
the  respective  interfaces  that  are  assigned  to  Facebook  user  accounts  using  the  cookie 
data  which  facilitate  comprehensive  profiling.  In  addition,  there  are  other  ways  in  which 
data  can  be  combined  with  Facebook  user  accounts  even  when  cookies  have  been 
disabled. 

664  Facebook  collects  a  large  amount  of  device-related  data  both  when  Facebook.com  and 
Facebook-owned  services  and  Facebook  Business  Tools  are  used.  In  their  entirety, 
these  represent  an  almost  unique  fingerprint  of  individual  users,  meaning  there  is  no 
need  to  assign  data  to  Facebook  user  accounts  via  cookies  in  the  first  place.  The 
possibilities  users  have  of  preventing  fingerprinting  are  limited  and  difficult  to  access 
due  to  the  technical  complexity  involved.  By  installing  browser  “add-ons“,  such  as 
"NoScript",  users  can  block  JavaScript  or  Flash,  meaning  that  less  information  can  be 
collected.  This  can  mean  that  websites  are  no  longer  displayed  correctly.  In  addition, 
they  represent  a  user  setting  that  can  enable  personalisation,  especially  if  only  a  small 
group  of  people  block  fingerprinting. 

665  This  explains  why  setting  options  on  mobile  devices  with  regard  to  the  advertising  ID 
certainly  do  not  provide  a  basis  for  voluntary  consent.  The  device  setting  also  leads  to 
the  advertising  ID  being  recorded  by  Facebook  via  the  mobile  interface.  This  results, 
for  instance  from  Facebook's  code  instruction  for  the  integration  of  the  "App  Events 
API".  This  means  the  advertising  ID  is  transmitted  every  time  users  access  the  app  and 
is  merely  supplemented  with  information  on  the  users'  settings  for  advertising 
tracking.593  The  setting  is  therefore  only  relevant  for  the  display  of  interest-based 
advertising.  Resetting  the  advertising  ID  does  not  prevent  further  assignment  of  data 
to  Facebook  user  accounts  either.  When  users  open  the  Facebook  app,  the  advertising 
ID  for  their  device  is  again  sent  to  Facebook  and  is  directly  assigned  to  their  Facebook 


593  Cf.  https://www.facebook.com/business/learn/how-business-manaaer-works/auide  .  [...] 
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user  account.  Users  would  then  need  to  manually  reset  the  advertising  ID  each  time  in 
order  to  make  it  more  difficult  to  collect  this  information. 

(3)  Data  processing  is  not  necessary  for  performance  of  the  contract,  Article  6  (1 
b)  GDPR 

666  The  processing  of  data  collected  from  Facebook-owned  services  and  Facebook 
Business  Tools  imposed  is  not  justified  pursuant  to  Article  6(1  b)  GDPR  contrary  to  the 
opinion  Facebook594  expressed  in  the  proceedings. 

667  For  a  start,  the  need  to  process  data  collected  from  other  Facebook-owned  services  or 
Facebook  Business  Tools  for  the  performance  of  the  contract  concluded  with  private 
users  cannot  be  justified  on  the  basis  of  the  contents  of  the  Terms  of  Service  that  are 
imposed  unilaterally  (see  (a)).  It  cannot  be  argued  that  there  is  a  contractual  link 
between  all  Facebook  Products.  (See  (b)).  Data  processing  from  all  sources  is  not 
necessary  for  the  claimed  contractual  purposes  either  (see(c)). 

(a)  Article  6  (1b)  GDPR  does  not  apply  when  the  contractual  contents  are  imposed 
unilaterally  by  the  dominant  company 

668  The  justification  set  forth  in  Article  6(1  b)  GDPR  is  not  applicable  on  the  basis  of  the 
statement  issued  by  the  Article  29  Data  Protection  Working  Party  when  a  dominant 
company  dictates  the  contractual  contents. 

669  In  describing  its  legal  basis  for  performance  of  the  contract,  Facebook  refers  to  the 
description  of  the  contents  of  the  contract  defined  in  the  Terms  of  Service  under  the 
heading  "Our  services".  Facebook  uses  a  headline  followed  by  a  few  examples  to 
describe  what  users  are  offered.  The  following  headlines  are  listed:  We  “Provide  a 
personalized  experience  for  you”,  “Connect  you  with  people  and  organizations  you  care 
about”,  “Empower  you  to  express  yourself  and  communicate  about  what  matters  to 
you”,  “Help  you  discover  content,  products,  and  services  that  may  interest  you”, 
“Combat  harmful  conduct  and  protect  and  support  our  community”,  “Use  and  develop 
advanced  technologies  to  provide  safe  and  functional  services  for  everyone”, 
“Research  ways  to  make  our  services  better”,  “Provide  consistent  and  seamless 
experiences  across  the  Facebook  Company  Products”,  “Enable  global  access  to  our 
services”. 


594  [  ] 
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670  In  the  present  proceedings,  Facebook  refers  in  connection  with  Article  6(1  b)  GDPR  in 
particular  to  the  provision  of  personalised  services  and  the  display  of  personalised 
advertising,  for  which  it  claims  all  data  processing  from  all  sources  is  necessary.595 

67 1  Neither  Facebook's  claim  in  the  present  proceedings  nor  the  one-sided  definition  of  the 
services  in  its  Terms  of  Service  can  justify  a  contractual  requirement  for  data 
processing  conditions  that  facilitate  comprehensive  processing  even  of  data  collected 
from  Facebook-owned  services  and  Facebook  Business  Tools  for  profiling  purposes, 
among  other  things.  With  regard  to  the  required  narrow  interpretation  of  the  justification 
set  forth  in  Article  6(1  b)  GDPR,  not  all  conceivable  data  processing  procedures 
associated  with  the  service  can  be  covered  by  the  economic  interest  of  a  self-defined 
data-driven  business  model  that  uses  personalised  services  and  personalised 
advertising.  The  Article  29  Data  Protection  Working  Party  has  always  represented  the 
view  in  relation  to  Article  7  of  Directive  75/46/EC  b)  which  is  identical  to  Article  6  (1b) 
GDPR  that  the  term  "necessary"  for  the  performance  of  the  contract  needs  to  be 
narrowly  construed.596  Contrary  to  Facebook's  view,  case  law  also  requires  a  narrow 
interpretation  of  these  grounds  for  justification.597 

672  This  means  that  data  processing  is  only  necessary  for  the  performance  of  the  contract 
if,  on  reasonable  grounds,  the  company's  reliance  on  the  specific  means  in  question 
can  be  affirmed  and  it  is  unreasonable  or  inacceptable  to  refrain  from  using  the  data.598 
However,  the  provision  does  not  apply  to  situations  where  processing  is  not  really 
necessary  for  the  performance  of  the  contract,  but  where  the  contents  of  the  contract 
and  data  processing  are  unilaterally  imposed  on  the  data  subject  by  the  controller.599 

673  Facebook's  claim  that  the  -  strongly  fact-driven  -  examination  required  by  the  guidelines 
issued  by  the  Article  29  Data  Protection  Working  Party  must  first  determine  the  exact 
purposes  of  the  contract,  i.e.  its  content  and  fundamental  objective,  and  whether  these 
purposes  are  crucial  for  assessing  the  balance  of  interests  and  whether  the  data 
processing  is  necessary  for  contractual  performance,  is  therefore  irrelevant.600  For  the 


595  [  j 

596  “Opinion  06/2014  on  the  concept  of  "legitimate  interest  of  the  controller  pursuant  to  Article  7  of  Directive 

95/46/EC"  of  9  April  2014, 

https://www.bfdi.bund.de/SharedDocs/Publikationen/DokumenteArt29Gruppe  EDSA/Stellungnahmen/WP217 

Qpinion62014Leaitimatelnterest.html.  [...] 

597  cf.  for  German  law  Hamburg  Administrative  Court,  judgment  handed  down  on  24  April  2017,  p.  32  with  reference 
to  Gola/Schomerus,  Federal  Data  Protection  Act,  Section  28,  para.  15  and  25. 

598  Hamburg  Administrative  Court,  judgment  of  24  April  2017,  p.  32. 

599  Opinion  06/201 4  on  the  concept  of  legitimate  interest  of  the  controller  pursuant  to  Article  7  of  Directive  95/46/EC" 

of  9  April  2014, 

https://www.bfdi.bund.de/SharedDocs/Publikationen/DokumenteArt29Gruppe  EDSA/Stellunqnahmen/WP217 

Opinion62Q14Leqitimatelnterest.html,  [...] 
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"fact-driven"  assessment  which  Facebook  refers  to  -  for  which,  incidentally,  Facebook 
bears  the  burden  of  proof  -  would  be  limited  solely  to  the  purposes  pursued  by 
Facebook  if  the  content  of  the  contract  was  determined  unilaterally.  Facebook's 
statement  in  this  particular  case  clearly  shows  this  too. 

674  There  is  no  evidence  to  suggest  that  under  the  GDPR  another,  in  particular  broader 
interpretation  of  the  justification  than  under  the  Directive  46/95/EG  is  required.601  The 
substantive  legal  situation,  which  was  already  fully  harmonised  with  the  justifications  in 
Article  7  of  Directive  95/46/EC  in  all  Member  States,  has  not  changed  as  a  result  of  the 
GDPR.  Also  the  Article  29  Data  Protection  Working  Party  reaffirmed  the  previous 
narrow  interpretation  of  the  justification  in  the  context  of  the  "Guidelines  on  automated 
decisions  in  individual  cases  including  profiling  for  the  purposes  of  Regulation 
2016/679”  for  Article  6  (1)  (b)  GDPR.602 

675  This  also  holds  true  most  particularly  when  taking  the  prohibition  of  making  the 
provision  of  a  service  conditional  on  consent  to  the  processing  of  personal  data  into 
account  that  is  now  governed  by  Article  7  (4)  GDPR.  Until  now,  it  had  to  be  denied  that 
voluntary  consent  exists  if  a  dominant  company  has  made  the  provision  of  its  service 
dependent  on  consent  to  all  data  processing  procedures  -  as  has  been  the  case  with 
Facebook  for  years603.  The  explicit  provision  governing  the  prohibition  of  making  the 
provision  of  a  service  conditional  on  consent  to  the  processing  of  personal  data  set 
forth  in  Article  7  (4)  4  GDPR,  if  there  is  a  clear  imbalance  between  the  data  subject  and 
the  organisation604,  therefore  does  not  expand  the  legal  justifications,  the  wording  of 
which  has  remained  unchanged,  in  order  to  compensate  for  the  limited  possibility  of 
obtaining  consent. 

676  Rather,  the  unilateral  imposition  of  contractual  contents  and  data  processing  must  also 
be  taken  into  account  within  the  framework  of  assessing  whether  they  are  necessary 
and  whether  a  company  has  a  dominant  position  in  the  market,  as  can  be  clearly  seen 
from  the  above-mentioned  arguments  put  forward  by  the  Article  29  Data  Protection 
Working  Party.  It  cannot  be  assumed  that  all  of  Facebook's  data  processing 
procedures,  for  which  consent  upon  registration  has  hitherto  been  invoked  as  the 
primary  legal  basis,  are  now  necessary  owing  to  the  extensive  and  unlimited  definition 


601  In  its  guidelines  on  consent  under  the  GDPR,  the  Article  29  Data  Protection  Working  Party  refers  explicitly  to 
WP  06/2014,  see  Art.  29  Data  Protection  Working  Party,  "Guidelines  in  relation  to  consent  under  Regulation 
2016/679, 

https://iapp.org/media/Ddf/resource  center/20180416  Article29WPGuidelinesonConsent  publishpdf.pdf,  [...] 

602  Guidelines  on  automated  decisions  in  individual  cases  including  profiling  for  the  purposes  of  Regulation 
2016/679  of  3  October  2017,  most  recently  revised  and  adopted  on  6  February  2018; 
https://www.facebook.com/leaal/terms?ref=pf .  [...] 
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of  services  in  the  T erms  of  Use  for  the  performance  of  the  contract.  Facebook  continues 
to  invoke  the  agreement  to  the  Terms  of  Service  which  users  are  still  required  to  give 
when  they  sign  up  with  the  service  that  forms  the  contract  between  Facebook  and 
users,  and  which  unilaterally  make  all  of  Facebook's  possible  interests  part  of  the 
contents  of  the  contract  with  users  who  must  then  agree  to  comprehensive  data 
processing.  The  former  mandatory  consent  to  data  processing  has  simply  been 
replaced  by  the  mandatory  agreement  to  the  Terms  of  Service  which  freely  determine 
the  contractual  necessity. 

677  When  determining  the  contractual  necessity,  it  is  essential  that  the  company’s 
dominant  position  in  the  market  also  be  taken  into  account  within  the  framework  of  the 
assessment.  For  users  cannot  exert  any  influence  on  the  contents  of  the  contract  that 
have  been  unilaterally  specified  in  the  Terms  of  Service,  nor  can  they  evade  the  Terms 
of  Service  resulting  in  such  extensive  data  processing  by  switching  providers,  since 
Facebook  is  the  dominant  company  in  this  market.  In  this  respect,  the  dominant 
company  has  a  special  responsibility  when  defining  the  product  characteristics  in  its 
Terms  of  Service  and  its  strategic  product  decisions,  which  completely  contradicts  the 
need  for  data  processing  as  defined  by  a  performance  promise  unilaterally  given  in  the 
Terms  of  Service.  This  is  why  the  justification  grounds  according  to  Article  6(1  b)  GDPR 
cannot  be  invoked.  In  any  such  case,  it  is  instead  the  voluntary  consent  pursuant  to 
Article  6(1  a)  GDPR  that  provides  the  relevant  and  necessary  legal  basis  for  data 
processing. 

(b)  No  contractual  link  between  all  Facebook  Products 

678  Even  if  Article  6(1  b)  GDPR  applied  to  unilaterally  determined  contractual  contents,  the 
Facebook-owned  services  offered  separately  by  Facebook.com  and  Facebook 
Business  Tools  cannot  be  made  the  subject  matter  of  the  contract  by  making  the 
provision  of  service  conditional  on  the  processing  of  personal  data  for  Facebook  users, 
for  instance  by  referring  in  the  Terms  of  Service  to  a  "more  personalised  and  consistent 
experience  in  all  Facebook  Products  used”. 

679  On  the  contrary,  taking  into  account  the  assessment  of  fundamental  rights  as  well  as 
the  fact  that  a  market-dominating  company  is  involved  means  the  subject  matter  of  the 
contract  needs  to  be  limited  and  the  necessity  of  data  processing  for  performance  of 
the  contract  must  be  subject  to  narrow  interpretation.  In  this  respect,  data  processing 
can,  in  principle,  only  be  considered  necessary  for  a  narrowly-defined  main  purpose  of 
the  contract,  beyond  which  not  all  data  processing  that  is  useful  is  actually 
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necessary.605  This  was  also  clearly  expressed  by  the  Article  29  Data  Protection 
Working  Party.  Accordingly,  the  fact  that  some  data  processing  is  covered  by  a  contract 
does  not  automatically  mean  that  the  processing  is  necessary  for  the  performance  of 
the  contract.  The  Article  29  Data  Protection  Working  Party  gives  the  necessity  of 
providing  a  delivery  address  when  ordering  goods  online  for  the  delivery  of  the  goods 
as  an  example.  Article  7  b)  of  Directive  95/46/EC  does  not  provide  any  basis  in  this 
case  for  creating  a  user  profile  regarding  their  product  preferences.606 

680  The  use  of  Facebook.com  does  not  include  the  use  of  the  other  Facebook-owned 
services,  for  which  independent  registration  processes  are  required  and  separate  user 
contracts  are  concluded.  Facebook  itself  contends  that  users  are  not  forced  to  use  the 
company's  other  services  in  addition  to  Facebook.607  It  is  not  clear  either  why,  however, 
these  products  should  nonetheless  be  part  of  the  user  experience  on  Facebook.com 
as  the  main  purpose  of  providing  the  service  Facebook.com  and  why  users  do  not  have 
the  possibility  of  deciding  for  themselves  on  the  cross-product  processing  of  their  data 
by  way  of  voluntary  consent. 

681  This  applies  not  only  to  the  services  operated  by  other  companies  belonging  to  the 
Facebook  Group,  such  as  WhatsApp,  Oculus  and  Masquerade.  Contrary  to  Facebook's 
claim608  it  applies  equally  to  the  combination  of  data  collected  from  Instagram  with 
Facebook  data.  Neither  the  fact  that  Instagram  is  operated  by  the  same  company 
belonging  to  the  Group  as  Facebook.com,  nor  the  identical  wording  of  Terms  of  Use 
and  data  policies  are  sufficient  to  substantiate  a  common  contractual  purpose. 

682  Instagram  is  also  a  predominantly  mobile  service  that  is  still  offered  separately  from 
Facebook.com,  requiring  independent  registration  and  login,  which  also  establishes 
independent  contractual  relationships.  Facebook  also  highlights  the  fact  that  users 
must  conclude  two  separate  contracts  in  order  to  use  Instagram  and  Facebook.com. 
Contrary  to  Facebook's  view,  it  therefore  cannot  be  assumed  that  providing  a 
consistent  experience  of  use  across  both  services  is  the  subject  matter  of  the  two 
contracts.609  Instagram  has  not  been  integrated  into  Facebook.com  in  the  sense  that 
Instagram  is  a  photo  service  that  is  part  of  Facebook.com's  offering,  which  would  be 


605  [  j 

606  Opinion  06/201 4  on  the  concept  of  legitimate  interest  of  the  controller  pursuant  to  Article  7  of  Directive  95/46/EC" 

of  9  April  2014, 

https://www.bfdi.bund.de/SharedDocs/Publikationen/DokumenteArt29Gruppe  EDSA/Stellungnahmen/WP217 

Qpinion62014Leaitimatelnterest.html.  [...] 
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problematic  under  antitrust  aspects.  This  also  applies  to  WhatsApp  and  other 
Facebook-owned  services. 

683  The  fact  that  users  are  informed  on  Facebook.com,  for  example,  if  friends  are  also 
active  on  Instagram  and  that  they  can  access  the  Facebook.com  service  via  a  link, 
does  not  lead  to  the  integration  of  services  that  pursue  a  common  contractual  purpose 
under  data  protection  law  with  all  the  data  processing  requirements  this  entails.  Rather, 
this  is  primarily  a  marketing  communication  for  Facebook-owned  products  aimed  at 
encouraging  Facebook  users  to  use  a  corresponding  photo  service  provided  by 
Facebook. 

684  That  the  Facebook.com  Terms  of  Service  stipulate  they  govern  the  "use  of  Facebook 
and  the  products,  features,  apps,  services,  technologies  and  software  that  we  offer  (the 
Facebook  Products  or  Products)",  "except  where  we  expressly  state  that  separate 
Terms  (and  not  these)  apply"  does  not  create  a  common  contractual  purpose,  but  only 
identical  terms  of  use  with  separate  contracts  being  concluded. 

685  Facebook  Business  Tools  are  also  integrated  and  used  on  a  separate  contractual 
basis  with  the  "Facebook  partners".  Facebook  Terms  of  Service  do  not  refer  to  the 
Facebook  Business  Tools  Terms  either.  The  subject  matter  of  the  contract  for  use  of  a 
social  network  by  consumers  cannot,  regardless  of  this,  extend  to  Facebook  Products 
offered  to  third  parties. 

686  This  also  applies  to  social  plugins  such  as  the  "Like"  button  or  the  "Share"  button  as 
well  as  to  the  Facebook  Login.  These  are  directly  related  to  the  features  of  a  social 
network,  as  they  allow  Facebook  users  to  communicate  directly  with  their  network  on 
Facebook.com  from  third-party  websites  or  apps,  and  to  log  into  third-party  websites  or 
apps  using  Facebook  registration  data.  Plowever,  the  provision  of  these  functionalities 
depends  on  whether  the  third-parties  enter  into  a  contract  with  Facebook  as  Facebook 
partners  meaning  they  cannot  be  a  mandatory  part  of  the  social  network  functionalities. 

687  The  measurement  and  analytics  services  implemented  via  the  Facebook  pixel  and  SDK 
are  also  available  to  third  parties.  Facebook  summarises  a  number  of  different  services 
that  fulfil  different  functions  under  the  term  "measurement  and  analytics  services"  (see 
above  para.  66ff).  Essentially,  a  distinction  can  be  made  between  the  measurement 
and  analysis  of  the  success  of  ads  placed  on  Facebook  and  the  measurement  and 
analysis  of  user  behaviour  on  websites  or  apps,  regardless  of  whether  they  are 
currently  Facebook  advertisers.  Both  variants  are  offered  on  the  basis  of  contracts  with 
third  parties.  Users  can  only  see  a  correlation  with  the  functionalities  of  a  social  network 
indirectly,  if  at  all,  with  regard  to  ads  on  Facebook.  The  "pure"  measurement  and 
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analytics  services  have  no  visible  correlation  for  users.  In  this  respect,  Facebook  is 
obviously  relying  on  Article  6(1  f)  GDPR  in  the  legal  bases  it  invokes. 

(c)  Data  processing  is  not  necessary  for  contractual  purposes 

688  Finally,  data  processing  cannot  be  deemed  necessary  for  the  purposes  indicated. 

689  The  subject  matter  of  the  contract  with  the  provision  of  a  "personalised  experience"  and 
of  "consistent  and  seamless  experiences  across  the  Facebook  Company  Products"  or 
combating  “harmful  conduct"  and  protection  and  support  community,  research  ways  to 
make  services  better,  etc.  are  phrased  so  vaguely  that  it  is  virtually  impossible  to 
assess  whether  or  not  they  are  necessary.  It  is  not  clear  either  which  data  is  specifically 
necessary  for  which  subject  matter  of  the  contract.  Facebook  has  not  submitted  any 
detailed  explanation.  The  above-mentioned  required  narrow  interpretation  of  Article 
6(1  b)  GDPR  does  not  permit  the  assertion  of  such  vaguely  phrased  contractual 
purposes. 

i.  Personalised  user  experience 

690  The  fact  that  data  processing  from  other  Facebook-owned  services  and  from  Facebook 
Business  Tools  might  be  useful  or  efficient  for  personalising  the  service  cannot  be 
justified  as  being  necessary  for  contract  purposes  either. 

691  In  the  present  proceedings,  Facebook  claims  primarily  that  the  data  provides  the  basis 
for  a  personalised  Facebook  user  experience,  consisting  of  the  fact  that  users  can  find 
the  individuals,  groups  and  content  that  interest  them  personally.  It  is  only  data  which 
users  share  about  themselves  and  the  information  which  Facebook  collects  about 
individual  user  behaviour  that  enable  Facebook  to  offer  users  this  personalised  user 
experience  in  the  first  place.610  According  to  Facebook,  the  very  essence  of  the 
Facebook  service  is  therefore  that  it  is  tailored  to  the  individual  user.611  Data  processing 
was  therefore  a  key  element  of  the  service  and  not  merely  a  side  effect.  The  offer  of 
targeted  advertising  was  also  part  of  this  personalised  user  experience.  Since 
advertising  is  necessary  to  finance  the  provision  of  the  network  free  of  charge, 
Facebook  claims  it  is  an  added  value  for  users,  instead  of  seeing  'random'  advertising, 
to  see  personalised  advertising  that  interests  them  more.  It  says  the  comprehensive 
collection  of  personal  data  is  necessary  to  provide  the  product.  Facebook  says  the 
broader  the  database,  the  more  effective  a  service  it  can  provide.612  It  claims  that 
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limiting  data  processing  is  always  unreasonable  because  it  interferes  with  Facebook's 
product  design. 

692  This  view  means  the  company  would  be  entitled  to  unlimited  data  processing  solely  on 
the  grounds  of  its  business  model  and  product  properties  as  well  as  the  company’s 
idea  of  product  quality.  Any  kind  of  data  processing  would  then  have  to  be  deemed 
“necessary  for  contractual  performance”  as  all  data  would  in  some  way  lead  to 
knowledge  being  obtained  about  the  individual  user,  users’  personal  profiles  being 
specified  and,  by  means  of  technical  algorithms,  the  social  user  experience  on 
Facebook  being  improved  and  users  being  shown  targeted  ads.  This  means  everything 
that  is  technically  possible  within  the  framework  of  progressive  digital  technology  could 
be  deemed  necessary  for  performance  of  the  contract.613 

693  The  possibility  of  comprehensive  data  processing  from  all  sources  as  the  only  effective 
performance  of  a  contract  would  not  represent  a  "balancing"  of  the  interests  concerned, 
which  Facebook  also  considers  to  be  necessary  within  the  framework  of  Article  6(1  b) 
GDPR614,  but  would  merely  serve  Facebook’s  own  commercial  interests.  For  the  mere 
usefulness  for  the  business  model  with  personalised  services  and  personalised 
advertising  means  the  justification  according  to  Article  6(1  b)  GDPR  and  thus  ultimately 
the  data  protection  lawfulness  would  be  completely  open  to  interpretation  by  the 
company.  The  company  would  not  need  to  assert  any  overriding  interest  in  data 
processing  with  regard  to  the  business  purpose  pursued  vis-a-vis  the  fundamental 
rights  of  the  data  subjects  pursuant  to  Article  6(1  f)  GDPR  or  even  to  obtain  their 
consent.  This  is  tantamount  to  relinquishing  the  fundamental  right  to  data  protection  or 
to  informational  self-determination. 

694  The  limited  possibilities  users  currently  have  of  influencing  the  level  of  personalisation 
of  the  service  cannot,  contrary  to  Facebook's  view,  be  used  as  "protective  measures” 
to  ensure  data  processing  is  balanced  and  proportionate.  Facebook  points  out  in  this 
regard  that  users  can  influence  the  product  properties  via  the  ad  settings,  by  giving 
feedback  on  their  content  and  by  using  the  News  Feed  settings.615  Fiowever,  these 
setting  options  have  no  impact  whatsoever  on  the  data  processing  terms  at  issue  here 
and  certainly  do  not  lead  to  a  relevant  limitation  of  data  processing.  In  some  cases,  the 
above-mentioned  options  actually  generate  additional  interest-based  user  data.  The 
very  fact  that  users  can  choose  not  to  be  shown  personalised  ads  based  on  partner 


613  Weichert,  DatenschutzverstoB  als  Geschaftsmodell  -  der  Fall  Facebook  (available  in  German  only),  DuD  2012, 
p.  716  (719)  with  reference  to  Lawrence  Lessig,  “Code  is  law  -  On  liberty  in  Cyberspace”, 
http://harvardmaaazine.com/2000/Q1/code-is-  law-html  (last  accessed  on  10  January  2019),  [...] 
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data  instead  shows  that  data  processing  for  the  personalisation  of  ads  is  not  necessary 
for  performance  of  the  contract. 

695  Furthermore,  the  Bundeskartellamt  considers  it  to  be  incorrect  that  Facebook  would  be 
unable  to  provide  a  personalised  service  with  Facebook.com  and  the  personalisation 
based  on  it  unless  it  processed  data  collected  from  Facebook-owned  services  and 
Facebook  Business  Tools.616  It  is  true  that  the  service  and  the  ads  shown  might  be  less 
accurate  and  effective  by  Facebook’s  own  standards  if  data  was  not  processed  from 
other  Facebook-owned  services  and  from  Facebook  Business  Tools.617  Flowever, 
contrary  to  Facebook's  view,  it  does  not  mean  Facebook  would  be  unable  to  provide 
the  service  outlined  in  the  user  contract  if  it  refrained  from  using  these  sources.618  Given 
the  amount  of  data  associated  with  Facebook  user  accounts  that  Facebook  already 
processes  when  the  social  network  is  used,  it  is  not  clear  what  significant  value  the 
data  from  these  sources  have  that  can  justify  a  personalised  use  of  the  social  network 
in  the  first  place. 

696  These  proceedings  specifically  do  not  involve  the  data  processing  procedures  that 
occur  when  the  social  network  is  used  under  the  Facebook  user  account.  It  remains  to 
be  seen  how  the  conflict  between  efficient  "big  data"  business  models  and  users’  right 
to  informational  self-determination  can  be  resolved  in  this  respect.  It  is  however  also 
extremely  doubtful  in  the  Bundeskartellamt's  opinion  whether  data  processing  on  the 
basis  of  Article  6(1  b)  GDPR  which  is  practically  unlimited  can  be  justified  by  claiming  it 
is  necessary  for  performance  of  the  contract  using  Terms  of  Service  that  are  imposed 
unilaterally.  Flere,  however,  in  individual  cases  Facebook  could  possibly  be  considered 
to  have  an  overriding  interest  pursuant  to  Article  6(1  f)  GDPR  in  processing  data 
generated  by  the  users  themselves  through  active  use  or  generated  automatically  in 
the  social  network  regarding  the  potential  efficiencies  of  data  processing  for  the  service 
and  its  users  as  well  as  independent  use  of  social  media  by  users.  Flere,  users  have 
considerable  possibilities  of  controlling  the  data  generated  about  them  in  terms  of 
extent  and  nature  of  their  activities  on  Facebook. 

697  Facebook’s  Data  Policy  says  that  all  content,  communications,  and  other  information 
users  provide  when  using  Facebook.com  is  collected  and  used.  This  includes 
information  users  provide  when  they  sign  up  for  an  account,  content  and  messages 
written  to  and  exchanged  with  others,  the  metadata  of  content  such  as  location  or  what 
users  see  when  they  look  through  the  Facebook  camera.  Facebook  records  all 
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networks  and  connections  on  the  social  network,  the  address  book  data  uploaded,  the 
contacts,  people,  Pages,  accounts,  hashtags  and  groups  that  users  are  connected  to. 
Facebook  collects  information  about  how  users  use  the  social  network,  such  as  the 
types  of  content  they  view  or  engage  with,  how  long  they  spend  looking  at  a  video  or 
advertisement,  the  frequency  and  duration  of  their  activities  as  well  as  financial 
transactions  carried  out  via  Facebook.com. 

698  Regardless  of  whether  this  amount  of  user  and  device-related  data  that  is  processed 
when  using  the  social  network  Facebook.com  is  actually  necessary  for  contractual 
performance,  it  is  utterly  incomprehensible  why  sufficient  personalisation  of  the  use  of 
Facebook.com  can  only  be  safeguarded  if  data  collected  from  other  Facebook-owned 
services  and  Facebook  Business  Tools  are  processed.  It  is  not  clear  from  the  Terms  of 
Service  or  the  policies,  the  Data  Policy  in  particular,  or  indeed  from  the  arguments  put 
forward  by  Facebook,  what  information  and  data  collected  from  the  individual 
Facebook-owned  services  and  Facebook  Business  T ools  is  necessary  for  performance 
of  the  contract,  and  why  it  is  even  necessary  in  the  first  place. 

699  This  initially  applies  to  the  Facebook-owned  services  Oculus  and  Masquerade  that 
are  offered  separately,  that  have  a  comparatively  low  penetration  rate  and  whose 
contribution  to  personalisation  for  all  Facebook  users  is  thought  to  be  relatively  small. 
The  WhatsApp  user  information  that  is  not  currently  used  to  "improve  the  product 
experience"  or  to  "display  more  interesting  advertising"  on  Facebook  according  to  the 
WhatsApp  FAQs619  is  not  necessary  for  the  purposes  claimed  either.  Plowever,  this 
also  applies  to  Instagram  data,  large  volumes  of  which  are  collected.  Given  that 
Facebook.com  has  a  much  larger  user  base  and  higher  usage  intensity,  it  is  not  clear 
what  Instagram’s  contribution  to  Facebook.com  is.  The  example  given  by  Facebook 
that  information  indicating  users  are  following  an  event  on  Instagram  is  also  used  to 
personalise  the  News  Feed  on  Facebook.com,  meaning  it  is  essential  for  contractual 
performance620,  is  not  convincing  either.  The  mere  usefulness  of  information  about  user 
behaviour  obtained  from  other  services  is  precisely  not  sufficient  to  justify  that  this 
information  is  necessary  to  provide  Facebook.com.621 

700  The  same  applies  to  Facebook  Business  Tools.  In  these  proceedings,  Facebook 
argues  that  data  collected  from  these  sources  are  necessary  for  personalising  the 
service  as  a  whole.622  In  addition,  Facebook  refers  to  other  legal  bases  for  data 
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processing  via  Facebook  Business  Tools,  in  particular  involving  consent  to  the 
processing  of  data  for  personalised  advertising,  processing  of  data  on  behalf  of  the 
data  controller  and  the  legitimate  interests  in  providing  measurements,  analytics  and 
other  corporate  services  when  Facebook  is  the  data  controller  processing  data.623 

701  Flowever,  the  processing  of  data  collected  from  Facebook  Business  Tools  imposed  is 
not  necessary  to  create  a  "personalised  user  experience"  or  for  the  associated  range 
of  functionalities,  insofar  as  they  are  connected  with  use  of  the  social  network. 

702  This  applies  first  and  foremost  to  the  social  plugins,  which  enable  Facebook  users  to 
communicate  directly  with  their  network  on  Facebook  from  third-party  websites  or  apps. 
The  social  plugins  make  it  possible  to  track  user  activities  on  the  website  and  the  URL 
of  the  previously  visited  website.  When  the  website  or  app  is  accessed,  the  Facebook 
server  automatically  receives  at  least  the  IP  address,  the  browser  type,  the  URL  of  the 
website  and  the  time  at  which  the  website  was  visited,  as  well  as  the  user  ID  or  ad  ID 
via  a  previously  set  cookie  that  transmits  the  user  ID  or  ad  ID  without  the  button  having 
to  be  pressed  by  the  user. 

703  Providing  a  "Like"  or  "Share"  button  or  another  social  plugin  for  Facebook  users  and 
third  parties  does  not  require  any  flow  of  data  to  Facebook  about  the  use  of  the  website 
if  the  user  does  not  interact  with  the  button.624  Only  when  the  user  clicks  on  the  button 
does  a  certain  data  record  become  necessary,  which  enables  data  to  be  assigned  to 
the  Facebook  user  account  under  which  it  is  to  be  distributed  on  Facebook.com.  The 
correct  display  of  the  website  taking  the  browser  configuration  into  account,  for  which 
some  standard  data  are  useful,  does  not  require  a  direct  data  flow  to  Facebook  either, 
but  to  the  website  operator.  It  is  obvious  that  it  is  not  necessary  for  the  functionality  to 
be  assigned  to  and  combined  with  the  data  already  stored  on  Facebook  under  the 
Facebook  user  account. 

704  Data  processing  via  the  Facebook  Login  and  Account  Kit  when  accessing  the  website 
or  app  without  the  user  pressing  the  button  is  not  necessary  to  offer  the  functionality  in 
connection  with  use  of  the  social  network  is  not  necessary  for  social  plugins  for  the 
same  reasons.  Similar  to  social  plugins,  by  integrating  the  Facebook  login,  Facebook 
receives  information  from  third-party  websites  and  apps  about  the  websites/apps 
Facebook  users  have  signed  up  with  and  how  they  use  the  respective  website/app.  As 
such,  it  is  just  as  unnecessary  for  the  user  to  activate  the  Facebook  Login  to  initiate  a 

623  [...] 

624  Cf.  also  the  Court  of  First  Instance  Belgium,  judgment  handed  down  on  16  February  2018,  p.  65  of  the  English 
translation,  [...]:  “The  court  concurs  with  the  point  of  view  of  the  Privacy  Commission ,  that  the  systematic 
collection  of  the  personal  data  of  users  and  non-users  via  social  plugins  on  the  websites  of  third  parties  is  not 
essential  (let  alone  „strictly  essential “  in  the  sense  of  Art.  129  ECA),  or  at  least  not  proportional  to  the 
achievement  of  the  safeguarding  objectives  (...)” 
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data  flow  as  it  is  for  the  social  plugins.  For  a  start,  the  volume  of  data  that  Facebook 
currently  receives  is  the  same  as  for  social  plugins.  The  company  also  receives  the 
login  information  the  user  enters  directly  and  manually  -  without  having  to  use  the 
Facebook  Login  -  with  the  provider  who  has  embedded  the  Facebook  Login.625 

705  There  is  no  need  for  data  to  flow  to  Facebook  about  the  use  of  the  website  or  even  the 
user's  login  data  without  the  user  interacting  with  the  button  in  order  to  provide  a 
convenient  log-in  option  for  Facebook  users  or  the  use  of  social  plugins.  Only  when 
users  click  the  button  does  a  limited  data  record  have  to  be  sent  to  Facebook  for  the 
login  data  to  be  transferred  to  the  website. 

706  The  comprehensive  data  processing  which  combines  data  from  the  measurement  and 
analytics  services  implemented  via  the  Facebook  pixel  and  SDKs  which  is  carried  out 
via  comprehensive  web  tracking  across  millions  of  websites  and  apps  is  not  necessary 
for  performance  of  the  contract  either.  What  these  services  have  in  common  is  that  in 
technical  terms  the  Facebook  pixel,  SDKs  or  another  interface  need  to  be  embedded 
in  a  third-party  website  or  app.  These  facilitate  a  massive  amount  of  data  processing 
for  a  wide  variety  of  data,  which  are  then  assigned  to  Facebook  user  accounts  -  also 
by  means  of  active  fingerprinting  (see  in  detail  above  para.  139ff.)  Any  such  massive 
web  tracking,  which  affects  users’  internet  usage,  cannot,  in  view  of  the  need  for  narrow 
interpretation  of  the  concept  of  necessity,  be  justified  pursuant  to  Article  6  1  b)  GDPR. 

707  Furthermore,  as  regards  measuring  the  success  of  advertising,  the  argument  that  the 
data  processing  imposed  is  necessary  in  order  to  be  able  to  display  personalised 
advertisements  effectively  [...]626,  cannot  be  used  to  explain  why  data  processing  is 
necessary  for  the  financing  of  Facebook  advertising  either.  The  fact  that  Facebook 
makes  use  of  data  collected  from  Facebook  partners  for  personalised  advertising 
conditional  on  users'  consent  mitigates  against  this. 

ii.  Other  contractual  purposes 

708  It  cannot  be  deemed  necessary  for  contractual  performance  for  other  purposes 
designated  as  the  subject  matter  of  the  contract  either. 

709  The  processing  of  data  collected  from  Facebook-owned  services  and  Facebook 
Business  Tools  imposed,  as  set  forth  in  the  Data  Policy,  is  not  necessary  to  provide 
"consistent  and  seamless  experiences  across  all  Facebook  Company  Products ”  or  for 
any  other  purposes  that  are  the  subject  matter  of  the  contract  as  part  of  contractual 
performance. 


625  [..■] 
626  [■■■] 
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710  For  a  start,  the  reservations  expressed  about  the  poorly  specified  terms  indicate  that 
this  purpose  of  the  contract  should  not  be  considered.  For  instance,  it  does  not  say 
specifically  what  “consistent  and  seamless  experiences  across  all  Facebook  Company 
Products”  actually  means  or  what  data  is  necessary  to  provide  this  experience. 
Integration  with  Facebook.com  in  the  sense  that  Instagram  or  WhatsApp  and  other 
products  are  perceived  as  part  of  Facebook.com’s  offering  would  also  be  questionable 
under  antitrust  law  as  it  makes  the  provision  of  the  service  conditional  on  the  processing 
of  users’  personal  data  of  those  other  services.  In  addition  to  de  facto  integration,  there 
is  a  risk  that  market  power  could  be  transferred  to  Instagram  and  other  services  by 
combining  data  into  a  de  facto  uniform  user  account  with  associated  and  shared  user 
data  and  by  transferring  friends  and  subscriber  lists  to  Instagram.  This  would  further 
secure  Facebook's  existing  market  power  despite  competition  from  Snapchat  or  other 
messenger  services  on  the  market’s  periphery.  Within  the  framework  of  the  concept  of 
"necessity"  and  the  consideration  that  needs  to  be  given  in  this  context,  Facebook’s 
dominant  position  in  the  market  must  therefore  also  be  taken  into  account. 

711  It  is  not  clear  what  importance  Facebook  Business  Tools  have  for  this  contractual 
purpose.  As  far  as  the  functionalities  of  the  social  plugins  and  the  Facebook  Login  are 
concerned,  it  cannot  be  assumed  that  a  data  flow  is  necessary  for  this  purpose  if  and 
when  the  functionalities  are  not  used. 

712  Nor  is  it  clear  with  regard  to  the  alleged  user  and  network  security,  including  the  security 
aspects  presented  by  Facebook  such  as  the  prevention  of  child  abuse  or  terrorist 
activities,  why,  irrespective  of  any  concrete  suspicion,  a  partially  unlimited  collection 
and  use  of  data  from  other  Facebook-owned  services  and  from  Facebook  Business 
Tools  should  be  necessary.627  Facebook  did  not  indicate  what  data  and  data 
processing  procedures  are  necessary  to  mitigate  the  general  dangers  associated  with 
using  the  Internet,  both  for  services  and  for  users,  and  which  are  used  solely  for  this 
purpose.  Preventative  defence  purposes  such  as  the  prevention  of  fraud  and  attacks 
on  computer  and  communication  systems,  as  presented  by  Facebook,  for  instance  in 
relation  to  the  prevention  of  automated  software  programmes  (so-called  "bots")628,  are 
at  best  recognised  as  legitimate  interests  in  Recitals  47,  49  of  the  GDPR  (see  below 
(5). 


627  cf.  also  with  regard  to  the  comparison  between  WhatsApp  and  Facebook  data  Hamburg  Administrative  Court, 
judgment  handed  down  on  24  April  2017,  p.  32. 

628  [..■] 
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713  The  same  applies  ultimately  to  the  research  purposes  mentioned  in  the  Terms  of 
Service.  It  is  not  clear  here  either  that  data  collected  from  other  Facebook  services  or 
Facebook  Business  Tools  are  essential  for  research  purposes. 

(4)  No  justification  for  special  purposes  pursuant  to  Article  6  (1  c)-e)  GDPR 

714  The  possibility  of  collecting  personal  data  of  users  of  the  social  network  from  Facebook- 
owned  services  and  Facebook  Business  Tools  pursuant  to  the  Data  Policy,  including 
the  combination  of  data  with  Facebook  user  accounts  as  well  as  use  of  any  such  data, 
is  not  justified  under  Article  6(1  c)-e)  GDPR  either. 

715  This  applies  if  only  because  data  processing  may  not  take  place  in  advance  in  the  event 
that  any  of  the  situations  or  tasks  governed  by  Article  6(1  c)-e)  GDPR  may  occur  or  be 
transferred.  Rather  the  respective  special  purpose  must  apply  when  the  respective  data 
processing  is  carried  out.  This  is  clearly  not  the  case. 

(a)  No  legal  justification  pursuant  to  Article  6  (1  c)  GDPR 

716  There  is  no  legal  obligation  pursuant  to  Article  6(1  c)  GDPR,  for  which  the  processing 
of  data  collected  from  Facebook-owned  services  or  Facebook  Business  Tools  is 
necessary  pursuant  to  the  Data  Policy. 

717  It  appears  that  Facebook's  published  legal  bases  and  Data  Policy  require  it  to  respond 
to  legal  requests  from  regulators,  law  enforcement  authorities,  and  other  executing 
authorities.  Facebook  then  accesses  and  stores  user  data  and  shares  them  with  the 
above-mentioned  authorities  in  response  to  legal  requests  if  Facebook  believes  in  good 
faith  that  it  has  a  legal  obligation  to  do  so.  Facebook  says  it  may  also  respond  to  legal 
requests  if  it  believes  in  good  faith  that  the  response  is  mandatory  under  the  law  of  the 
jurisdiction  concerned,  affects  users  in  that  jurisdiction  and  corresponds  to 
internationally  accepted  standards. 

7 1 8  Flowever,  any  required  response  to  legal  requests  and  an  obligation  to  respond  to  these 
requests  may  not  justify  data  being  collected  from  Facebook-owned  services  or 
Facebook  Business  Tools  or  data  being  combined  with  Facebook  user  accounts.  This 
data  processing  is  not  even  covered  by  Facebook's  own  wording  in  the  Terms  of 
Service,  which  deals  with  data  access,  storage  and  transfer  to  the  authorities,  but  not 
with  the  collection  and  combination  of  data. 

719  Article  6(1  c)  GDPR  also  calls  for  a  clear,  precise  and  predictable  legal  basis  for  data 
processing,  which  must  be  in  the  public  interest.  No  such  legal  basis  is  apparent  here. 
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Data  processing  would  have  to  be  carried  out  only  to  the  extent  required  by  the  legal 
obligation,629  meaning  that  even  "good  faith"  in  a  legal  obligation  is  not  sufficient. 

(b)  No  vital  interests,  Article  6  (1  d)  GDPR 

720  It  is  not  clear  either  that  the  collection  and  processing  of  personal  data  from  Facebook- 
owned  services  and  Facebook  Business  Tools  on  the  basis  of  Article  6  (Id)  GDPR 
could  be  justified  in  order  to  protect  vital  interests  of  the  person  concerned  or  another 
natural  person. 

721  Facebook  claims  in  the  published  legal  basis  that  the  “  vital  interests”  it  relies  on  for  this 
processing  include  “ protection  of  your  life  or  physical  integrity  or  that  of  others". 

722  This  legal  basis  calls  for  a  situation  posing  a  concrete  risk  for  life  and  limb  in  which  the 
data  subject  is  unable  to  give  consent  for  physical  or  legal  reasons.630  Here,  too,  data 
processing  cannot  take  place  in  advance  in  order  to  cover  the  abstract  eventuality  of 
any  such  situation  occurring. 

(c)  No  public  interest,  Article  6  (1  e)  GDPR 

723  The  same  applies  to  invoking  public  interests  pursuant  to  Article  6  (1  e)  GDPR,  of  which 
there  is  no  evidence  here  either. 

724  Facebook  refers  in  the  published  legal  bases  to  tasks  carried  out  in  the  public  interest 
including  "research  for  the  benefit  of  society  and  to  promote  protection,  integrity  and 
security "  where  this  is  necessary  in  the  public  interest  as  laid  down  by  Union  law  or 
Member  State  law  to  which  it  is  subject.631  In  its  Data  Policy,  Facebook  says  that  it  uses 
the  information  it  has  to  verify  accounts  and  activity,  combat  harmful  conduct,  detect 
and  prevent  spam  and  other  bad  experiences,  maintain  the  integrity  of  its  products,  and 
promote  safety  and  security  on  and  off  Facebook  Products.  For  instance,  Facebook 
uses  data  to  investigate  suspicious  activity  or  breaches  of  its  Terms  or  Policies,  or  to 
detect  when  someone  needs  help. 

725  Furthermore,  Facebook  indicates  in  its  Data  Policy  that  it  uses  the  information  that  it 
has  (including  from  research  partners  it  collaborates  with)  to  conduct  and  support 
research  and  innovation  on  topics  of  general  social  welfare,  technological 
advancement,  public  interest,  health  and  well-being.  For  example,  Facebook  says  it 
analyses  the  information  it  has  about  migration  patterns  during  crises  to  aid  relief 


629  Ehmann/Selmayr,  GDPR,  Article  6,  para.  16; 

630  Auernhammer,  GDPR,  Art.  6  recital  22;  Ehmann/Selmayr,  GDPR,  Art.  6,  recital  17. 

631 
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efforts.  A  hyperlink  takes  users  to  an  English-language  page  on  Facebook's  research 
programmes. 

726  This  does  not  justify  the  processing  of  data  imposed  that  is  collected  from  Facebook- 
owned  services  and  Facebook  Business  Tools  pursuant  to  Article  6(1  e)  GDPR.  The 
justification  presupposes  that  the  processing  is  necessary  for  a  public  task  which  is  in 
the  public  interest.  The  data  controller  must  be  assigned  a  task  by  law  the  performance 
of  which  is  in  the  public  interest.632  This  is  not  apparent  in  any  of  the  above-mentioned 
"public  interests".  Neither  can  it  be  assumed  that  the  data  processing  imposed  is 
necessary  in  the  public  interest. 

(5)  No  justification  because  of  overriding  interests  pursuant  to  Article  6  (1  f) 
GDPR 

727  Contrary  to  Facebook's  view,  the  processing  of  data  collected  from  Facebook-owned 
services  and  via  Facebook  Business  Tools  imposed  in  Facebook's  Terms  of 
Services633  is  not  justified  for  the  balancing  of  interests  pursuant  to  Article  6  (1  f)  GDPR. 

728  Data  processing  is  permissible  pursuant  to  Article  6  (1  f)  GDPR  for  the  purposes  of  the 
legitimate  interests  pursued  by  the  controller  or  by  a  third  party,  taking  the  data 
processing  principles  governed  by  Article  5  GDPR  into  account,  except  where  such 
interests  are  overridden  by  the  interests  or  fundamental  rights  and  freedoms  of  the  data 
subject  which  require  protection  of  personal  data. 

729  The  wording  of  the  standard  has  not  changed  since  Article  7(f)  of  Directive  46/95/EC. 
The  entry  into  force  of  Article  6(1  f)  GDPR  does  not  bring  about  any  substantive  change 
in  the  facts  at  hand.  The  guidelines  issued  by  the  Article  29  Data  Protection  Working 
Party  on  the  concept  of  the  legitimate  interest  of  the  controller  pursuant  to  Article  7  of 
Directive  95/47/EC634  may  therefore  also  be  used  as  a  basis  for  the  examination  of 
Article  6(1  f)  GDPR.  These  guidelines  are  also  referred  to  in  the  guidelines  issued  by 
the  Article  29  of  the  Data  Protection  Working  Party  on  automated  decisions  in  individual 
cases,  including  profiling  for  the  purposes  of  Regulation  2016/679,  drawn  up  for  the 
GDPR.635 

730  According  to  the  guidelines  issued  by  the  Article  29  Data  Protection  Working  Party,  the 
justification  calls  for  comprehensive  examination  of  the  balance  between  the  legitimate 

632  Auernhammer-Kramer,  GDPR,  Article  6,  para.  14 

633  [  ] 

634  Opinion  06/201 4  on  the  concept  of  legitimate  interest  of  the  controller  pursuant  to  Article  7  of  Directive  95/46/EC" 

of  9  April  2014, 

https://www.bfdi.bund.de/SharedDocs/Publikationen/DokumenteArt29Gruppe  EDSA/Stellunqnahmen/WP217 

Opinion62Q14Leqitimatelnterest.html,  [...] 

635  http://ec.europa.eu/newsroom/article29/item-detail.cfm7item  id=612053.  S.  15  f.,  [...] 
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interests  of  the  controller  or  of  a  third  party  and  the  interests  or  fundamental  rights  of 
the  data  subject.  In  addition  to  determining  the  respective  interests  and  rights 
concerned  and  their  justification,  the  guidelines  for  further  consideration  also  require 
key  factors  to  be  taken  into  account  which  are  described  in  the  evaluation  of  the 
balancing  of  the  legitimate  interests  of  the  controller  or  third  parties  and  the  necessity 
of  data  processing  for  the  representation  of  those  interests 

•  the  evaluation  of  the  balancing  of  the  legitimate  interests  of  the  controller  or  third 
parties  and  the  necessity  of  data  processing  for  the  representation  of  those 
interests,636 

•  the  consequences  for  data  subjects,  taking  into  account  the  nature  of  the  data  to  be 
processed,  the  legitimate  expectations  of  the  data  subjects,  the  position  of  the 
controller  and  of  the  data  subject,  including  any  dominant  position,637 

•  any  additional  measures  which,  if  interests  and  rights  are  not  clearly  balanced,  are 
capable  of  striking  a  balance,  including  user-friendly  appeals,  additional 
transparency,  data  minimisation  and  data  protection-friendly  alternatives.638 


731  On  this  basis,  a  justification  of  the  data  processing  imposed  based  on  the  factors  to  be 
included  in  the  consideration  is  neither  apparent  for  the  data  from  Facebook-owned 
services  (see  (a),  nor  for  the  data  from  Facebook  Business  Tools  (see  (b). 

(a)  Facebook-owned  services 

732  The  data  processing  for  the  recording  of  user  data  from  the  Facebook-owned 
companies  WhatsApp,  Oculus  and  Masquerade,  that  is  possible  according  to 
Facebook's  Terms  of  Service,  and  the  combination  of  data  generated  when  using 
Facebook.com  with  data  generated  using  Facebook  user  accounts  and  the  use  of  any 
such  data  is  not  justified  by  overriding  legitimate  interests  of  Facebook  or  third  parties 
vis-a-vis  the  interests  and  rights  of  the  user.  This  also  applies  to  the  combination  data 
obtained  through  the  use  of  the  Instagram  service  offered  by  Facebook  Ireland  Ltd. 
with  the  data  generated  through  the  use  of  Facebook.com  under  Facebook  user 
accounts,  as  well  as  their  combined  use. 


636  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  43  ff.,  [...] 

637  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  47ff.,  51.;  [...] 

638  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  52  ff.,  [...] 
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733  The  processing  of  data  collected  from  Facebook-owned  services  imposed  is  for  the 
most  part  not  covered  by  legitimate  interests  as  they  have  been  neither  clearly 
articulated  nor  are  they  necessary  (see  i.).  In  weighing  up  the  consequences  for  the 
users  concerned,  the  key  factors  that  need  to  be  considered  are  the  interest  and  right 
of  users  to  the  protection  of  their  privacy  and  autonomy  (see  ii.).  There  are  no  protective 
measures  apparent  that  strike  a  fair  balance  of  interests  (see  iii.). 

i.  Legitimate  interests 

734  Both  Facebook  and  third  parties  can,  in  principle,  assert  legitimate  interests  in  relation 
to  data  processing  within  the  Facebook  Group.  Flowever,  to  a  large  extent,  Facebook 
has  neither  sufficiently  explained  nor  otherwise  made  clear  why  internal  data 
processing  within  the  group  is  necessary  for  the  representation  of  these  interests. 

•  Facebook’s  interests 

735  The  goals  Facebook  has  mentioned  in  these  proceedings,  namely  Facebook.com’s 
personalisation,  including  targeted  advertising,  measurement  and  analytics  purposes, 
user  and  network  security  as  well  as  the  research  purposes  and  responses  to  legal 
requests  referred  to  in  the  legal  bases  published,  can  in  principle  represent  legitimate 
interests  pursuant  to  Article  6(f)  GDPR.  According  to  the  guidelines  issued  by  the  Article 
29  Data  Protection  Working  Party,  the  term  covers  a  broad  spectrum  of  legitimate 
interests,  ranging  from  interests  that  are  null  and  void  right  up  to  very  compelling 
interests,  uncomplicated  or  contentious  interests.639  Flowever,  the  key  issue  is  whether 
the  legitimate  interest  has  been  sufficiently  clearly  articulated  to  weigh  up  the  balance 
of  interests  and  whether  legitimate  interests  apply  in  the  present  situation. 

o  Legitimate  interests  have  not  been  articulated  clearly  enough 

736  The  legitimate  interests  have  not  been  articulated  clearly  enough  on  this  basis.  In  the 
present  proceedings,  Facebook  presents  legitimate  interests  only  in  general  terms  and 
merely  repeats  the  information  about  legitimate  interests  in  the  legal  bases  referred  to 
in  its  Data  Policy.640 

737  Accordingly,  Facebook  (also)  refers  to  its  legitimate  interests  with  respect  to  Facebook- 
owned  services  for  persons  under  the  age  of  majority  and  persons  who  have  a  limited 
ability  to  enter  into  an  enforceable  contract,  since  the  justifications  of  necessity  for 
contractual  performance  and  consent  cannot  be  invoked  in  relation  to  them.  In  the  case 
of  minors,  Facebook  claims  that  personalisation  and  targeted  advertising,  as  well  as 
protection,  integrity  and  security,  and  the  provision  of  non-marketing  communications 

639  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  31 ;  [. . .] 

640  [  ] 
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are  indeed  legitimate  interests.  In  addition,  Facebook  claims  marketing  interests  for  the 
promotion  of  Facebook-owned  products  and  direct  advertising  as  well  as  research 
interests  necessitate  the  processing  of  data  collected  from  Facebook-owned  services. 
It  says  the  processing  of  data  collected  from  Facebook  Business  Tools  is  necessary 
for  the  interests  in  providing  measurements,  analytics  and  other  company  services 
when  Facebook  is  the  data  controller.641 

738  This  statement  does  not  represent  a  sufficiently  clear  articulation  of  the  legitimate 
interests  that  could  be  used  to  balance  the  interests  and  rights  of  the  data  subject.  For 
it  does  not  substantiate  in  detail  Facebook's  own  interests,  such  as  security  interests 
or  provide  a  differentiated  explanation  as  to  why  data  needs  to  be  collected  and 
recorded  specifically  from  Facebook-owned  services  or  why  this  data  needs  to  be 
assigned  to  Facebook  user  accounts.  Facebook  does  not  explain  what  type  of  data 
processing  is  involved  either,  in  particular  the  profiling  used  to  personalise  the  service 
and  for  advertising  purposes  or  what  contribution  the  data  collected  from  Facebook- 
owned  services  make.  In  this  respect,  Facebook  merely  claims  in  this  particular  case 
that  the  Decision  Division  refers  to  data  processing  as  “profiling”.642  Flowever, 
according  to  the  guidelines  issued  by  the  Article  29  Data  Protection  Working  Party, 
legitimate  interests  can  only  be  asserted  for  certain  data  and  certain  types  of  data 
processing.  Facebook  declares  in  this  respect  that  all  data  processing  serves  its 
overriding  legitimate  interests.  Accordingly,  Facebook's  data  processing  terms  also 
reserve  the  right  to  process  any  data,  including  data  processing  within  the  Group. 

739  Facebook  carries  the  burden  of  proof  in  relation  to  the  prerequisites  of  justification 
pursuant  to  Article  6  (1  f)  GDPR.  The  Bundeskartellamt  does  not  need  to  determine  ex 
officio  the  interests  possibly  pursued  by  the  company  within  its  sphere  or  the  individual 
data  processing  procedures  ascribed  to  them  or  even  their  significance  for  the 
company  in  order  to  prove  that  no  justification  exists.  This  ensues  both  from  the  legal 
prohibition  subject  to  permission  under  data  protection  law  which  all  processing  of 
personal  data  is  subject  to,  and  from  the  principle  of  the  accountability  enshrined  in 
Article  5  (2)  GDPR,  which  makes  the  controller  responsible  for  compliance  with  the 
regulations  governing  lawful  data  processing.  Article  24  (1)  GDPR  explicitly 
emphasises  that  the  controller  is  obliged  to  demonstrate  that  processing  is  performed 
pursuant  to  the  GDPR.  Art.  30  GDPR  says  that  the  controller  must  maintain  a  record 
of  processing  activities  under  its  responsibility  in  order  to  prove  compliance  with  the 
provisions  set  forth  in  the  GDPR.  The  controller  himself  must  therefore  not  only  ensure 


641  [...] 
642  [...] 
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that  the  processing  complies  with  the  GDPR,  he  must  also  be  in  a  position  to  prove  that 
he  has  undertaken  everything  necessary  to  achieve  the  objective  and  has  taken 
suitable  measures  accordingly.643  But  also  the  antitrust  provisions  set  forth  in  Section 
19  GWB  do  not  oblige  the  antitrust  authority  to  prove  the  justifications  for  anti¬ 
competitive  behaviour  within  the  framework  of  the  principle  of  ex-officio  investigation. 
Here,  too,  the  norm  addressee  is  responsible  for  explaining  the  circumstances  within 
the  company's  sphere.  To  this  end,  the  Bundeskartellamt  has  expressly  requested 
Facebook  to  explain  the  circumstances  on  several  occasions,  in  particular  with  the 
preliminary  assessment  notice  sent  to  Facebook  in  December  2017,  with  previously 
submitted  documents  and  in  discussions. 

740  Facebook  wrongly  believes  in  this  regard  that  the  Decision  Division  assumes  "abuse 
due  to  lack  of  justification"  and  that  it  did  not  investigate  the  conduct.644  In  particular, 
Facebook  fails  to  recognise  that  the  conduct  in  this  case  is  the  actual,  comprehensive 
data  processing  that  has  been  imposed  and  carried  out  pursuant  to  the  Terms  of 
Service  and  the  Data  Policy  and  that  it  is  this  very  conduct  that  requires  objective 
justification. 

o  The  data  processing  imposed  is  not  necessary 

741  It  cannot  be  assumed  following  the  investigations  carried  out  by  the  Bundeskartellamt, 
regardless  of  Facebook's  explanations,  that  the  extent  of  data  processing  possible 
under  the  Terms  of  Service  and  the  data  processing  actually  implemented  are 
necessary  for  the  above-mentioned  purposes. 

742  The  guidelines  issued  by  the  Article  29  Data  Protection  Working  Party  say  in  relation 
to  legitimate  interests  that  data  processing  must  be  necessary  for  the  intended 
purposes.645  The  term  also  needs  to  be  narrowly  interpreted  within  the  framework  of 
legitimate  interests  and  does  not  apply  just  because  it  is  useful  or  expedient.  Rather, 
data  processing  must  be  essential  for  achieving  the  purposes,  and  the  purposes  must 
not  be  achievable  by  any  other  means.  According  to  the  guidelines  issued  by  the  Article 
29  Data  Protection  Working  Party,  it  needs  to  be  considered  whether  there  are  any 
other  data  protection-friendly  alternatives  available  -  such  as  voluntary  user  options.  In 
this  respect,  the  definition  of  necessity  does  not  need  to  be  more  broadly  construed 
than  in  the  previous  justifications  pursuant  to  Article  6  (1  b)-e)  GDPR.  On  the  contrary, 
the  Article  29  Data  Protection  Working  Party  points  out  that  the  need  for  “necessity”  is 
particularly  relevant  for  Article  6  (If)  GDPR  in  order  to  ensure  that  the  processing  of 


643  Plath,  GDPR/Federal  Data  Protection  Act,  3rd  edition  2018,  Article  24,  para.  19 

644  [  ] 

645  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  37;  [...] 
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data  based  on  legitimate  interests  does  not  lead  to  an  inappropriately  broad 
interpretation  of  the  necessity  of  data  processing  in  the  first  place.646 

743  On  this  basis,  the  processing  of  data  collected  from  Facebook-owned  services  is  not 
necessary  for  the  personalisation  or  individualisation  of  Facebook.com.  It  is  true  that 
the  interest  in  high-quality  personalisation  and  individualisation  of  the  service  provided 
by  social  networks  is,  in  principle,  important  and  that  the  quality  and  efficiency  argument 
should  be  taken  into  consideration  from  the  antitrust  perspective.  It  is  also 
acknowledged  that  each  individual  data  is  also  beneficial  (see  above  para.  702). 
Flowever,  data  processing  is  not  necessary  for  usefulness  and  efficiency. 

744  With  regard  to  the  special  meaning  of  necessity,  in  the  context  of  the  legitimate  interest 
pursuant  to  Article  6  (If)  GDPR  just  as  with  Article  6  (1b)  GDPR,  the  interests  in  the 
chosen  business  model  of  a  personalised  service  financed  with  targeted  advertising 
cannot  lead  to  all  data  processing  procedures  that  provide  additional  information  about 
the  individual  user  being  necessary  (see  above  para.692).  It  also  needs  to  be  pointed 
out  in  this  context  that  Facebook  can  achieve  a  high  degree  of  personalisation  and 
individualisation  with  the  data  generated  from  Facebook.com  itself.  It  has  not  been 
argued  nor  is  it  apparent  what  crucial  contribution  user  data  collected  from  other 
Facebook-owned  services  make  towards  accomplishing  this  goal  that  rules  out  a  less 
intrusive  measure  -  such  as  a  user  option. 

745  In  the  case  of  the  Oculus  and  Masquerade  services,  the  fact  that  they  currently  have  a 
comparatively  low  level  of  penetration  indicates  that  the  processing  of  data  is  not 
necessary  for  personalisation  purposes.  Flowever,  the  additional  device-related  data 
associated  with  these  services,  which  can  provide  information  about  user  behaviour  on 
the  devices  with  regard  to  online  websites  and  apps,  including  those  of  competitors,  is 
of  great  value  even  for  a  relatively  small  user  base,  since  successful  applications  can 
be  identified  by  competitors  at  an  early  stage.  Irrespective  of  whether  this  circumstance 
is  covered  by  the  purpose  of  personalisation  and  individualisation,  it  is  doubtful  whether 
this  can  be  regarded  as  a  legitimate  interest  under  antitrust  law.  In  any  case,  however, 
it  must  be  taken  into  account  in  the  balancing  of  interests  that  competitive  user  data 
are  also  collected. 

746  The  WhatsApp  user  information  that  is  not  currently  used  to  "improve  the  product 
experience"  or  to  "display  more  interesting  advertising"  on  Facebook  according  to  the 
WhatsApp  FAQs,647  is  not  necessary  for  the  purposes  claimed  either.  Even  though  the 


646  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  37;  [...] 

647  Cf.  https://www.facebook.com/business/learn/how-business-manaaer-works/auide  .  [...] 
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scope  and  purpose  of  the  data  transfer  and  the  use  of  this  data  are  ultimately  unclear, 
also  with  regard  to  a  potential  integration  of  the  services,  for  a  start  the  current  actual 
data  processing  shows  there  is  no  reason  to  assume  that  the  data  used  for 
personalisation  and  individualisation  purposes  is  absolutely  necessary.  This  also 
applies  to  Instagram  data  which,  after  the  service  was  transferred  to  Facebook  Ireland 
Ltd.,  is  not  subject  to  any  restrictions  on  combination  or  combined  use  of  data  under 
the  identical  Facebook  and  Instagram  policies  particularly  for  profiling.  As  indicated 
above,  the  existing  connections  between  Instagram  and  Facebook.com  do  not  mean  it 
is  necessary  to  process  Instagram  user  and  device-related  data  for  the  personalisation 
of  the  service  and  advertising  on  Facebook.com  unless  users  have  control  (para.699). 

747  Insofar  as  in  the  present  case  the  vaguely  defined  interest  in  the  "consistency  of  the 
user  experience"  and  in  further  integrating  both  services  is  to  be  claimed648,  the 
"justification"  of  this  interest  must  be  called  into  question  under  antitrust  law.  For 
integrating  services  -  also  de  facto  by  integrating  functionalities  and  shared  user 
accounts  including  shared  user  data  assigned  to  Facebook  user  accounts  -  is 
problematic  under  antitrust  law.  Integration  can  transfer  and  safeguard  market  power, 
can  exclude  other  market  players  and  create  barriers  to  market  entry  for  competitors 
such  as  Snapchat. 

748  For  example,  enabling  users  to  communicate  directly  between  the  Facebook.com, 
WhatsApp,  and  Instagram  services  would  create  economies  of  scale  by  harnessing  the 
direct  network  effects  of  each  service.  The  creation  of  compatibility  and  an  "end-to-end 
connection"  neutralises  the  effect  of  direct  network  effects  limited  to  the  compatible 
networks.  Switching  to  services  is  facilitated  or  becomes  unnecessary,  which  greatly 
enhances  the  lock-in  effect  for  all  services  and  is  a  major  barrier  to  switching  from 
compatible  services  to  alternative  incompatible  services.  This  results  in  the  transfer  of 
market  power  between  the  compatible  services  and  to  securing  Facebook's  market 
position. 

749  The  combination  of  all  user  data  associated  with  this  would  therefore  constitute  a 
significant  competitive  risk  by  creating  further  barriers  to  market  entry  and  major 
obstacles  for  switching  providers.  Any  such  risk  must  in  any  case  be  taken  into  account 
in  the  balancing  of  interests  vis-a-vis  the  interests  and  rights  of  users.  From  this  point 
of  view,  the  interests  of  marketing,  the  promotion  of  Facebook  Products  and  direct 
advertising  mentioned  in  Facebook's  legal  bases  must  also  be  deemed  at  the  very  least 


648  Cf.  insofar  the  plans  which  have  become  known  on  the  further  integration  of  Facebook,  WhatsApp  and 
Instagram  (source  available  in  German 

onlvfhtt  os  ://www.  welt.de/wirtschaft/webwelt/article187738456/Zuckerberq-plant-Verknuepfuna-von-WhatsApp- 

lnstaaram-und-Facebook.html 
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sensitive  under  antitrust  law.  The  extent  of  potential  data  processing,  in  particular  with 
regard  to  Instagram  and  WhatsApp,  but  also  with  regard  to  the  Group's  other  services, 
therefore  cannot  be  deemed  necessary  for  this  purpose. 

750  Furthermore,  it  is  not  clear  with  regard  to  the  alleged  user  and  network  security 
including  the  security  aspects  presented  by  Facebook  such  as  the  prevention  of  child 
abuse  or  terrorist  activities  why,  irrespective  of  any  concrete  suspicion,  a  partially 
unlimited  collection  and  use  of  data  from  other  Facebook-owned  services  is 
necessary.649  Preventative  defence  purposes,  such  as  the  fight  against  fraud  and  the 
prevention  of  attacks  on  computer  and  communication  systems,  are  recognised  as 
legitimate  interests  in  the  Recitals  of  the  GDPR.  Flowever,  it  can  be  clearly  inferred 
from  the  Recitals  to  the  GDPR  that  data  processing  which  pursues  preventative 
defence  purposes  is  only  permissible  if  it  is  limited  to  compellingly  necessary  measures 
and  does  not  reach  an  intensity  that  is  disproportionate  to  the  purposes  pursued.650 
Facebook  did  not  indicate,  as  outlined  above,  which  data  and  data  processing 
procedures  are  necessary  for  the  individual  general  dangers  it  mentions  in  relation  to 
use  of  the  Internet,  both  for  services  and  for  users,  and  which  are  only  used  for  this 
purpose.  As  such,  it  is  extremely  doubtful  that  the  unlimited  combination  of  Instagram 
data  and  data  generated  with  Oculus  and  Masquerade  is  necessary  for  security 
purposes. 

751  The  Bundeskartellamt  does  not  see  either  why  the  data  WhatsApp  currently  transfers 
to  Facebook  is  necessary  for  the  alleged  security  purposes.  It  remains  unclear  what 
contribution  the  phone  number  provided  to  WhatsApp  upon  registration  and  the  device- 
related  information,  the  "last  seen"  information  and  the  login  data  and  features  used  to 
identify  security  threats  or  "malicious  users”651  make.  It  is  not  clear  either  why  an  event- 
driven  combination  is  not  sufficient  for  identification  purposes.  In  a  notice  issued  by 
Flamburg’s  Data  Protection  Commissioner  on  23  September  2016  -  confirmed  by 
Hamburg  Administrative  Court  and  Hamburg  Higher  Regional  Court652  in  summary 
proceedings  -  Facebook  Ireland  Ltd.  is  prohibited  the  aforementioned  data  collection 
and  storage  on  the  basis  of  the  previously  applicable  Federal  Data  Protection  Act  for 
lack  of  overriding  interest,  unless  consent  is  given.653  The  additional  processing  of  data 

649  cf.  also  with  regard  to  the  comparison  between  WhatsApp  and  Facebook  data  Hamburg  Administrative  Court, 
judgment  handed  down  on  24  April  2017,  p.  32. 

650  cf.  Recital  47  sentence.  6  GDPR  on  fraud  prevention:  “strictly  necessary”,  Recital  49  on  data  and  information 
security  “strictly  necessary  and  proportionate”;cf.  also  Harting,  General  Data  Protection  Regulation  para.  439 

651  Facebook's  submission  in  the  proceedings  before  Hamburg  Administrative  Court,  see  judgment  handed  down 
on  24  April  2017,  ref.  13  E  5912/16,  p.  14,  [...] 

652  Hamburg  Administrative  Court,  judgment  of  24  April  2017,  ref.  13  E  5912/16,  [...],  Hamburg  Higher  Regional 
Court,  judgment  of  26  February  2018,  ref.  5  Bs  93/17 

653  Statement  of  the  Hamburg  Commissioner  for  Data  Protection  and  Freedom  of  Information  of  23  September 
2016,  [...] 
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generated  from  WhatsApp  reserved  in  Facebook's  Terms  of  Service  for  security 
purposes  is  even  less  necessary. 

752  The  largely  unrestricted  data  processing  from  corporate  services  is  not  necessary  for 
internal  Group  measurement  and  analytics  purposes  either.  In  particular,  Facebook 
cannot  invoke  the  privilege  of  intra-group  data  exchanges  for  this  purpose  (see  above, 
para.  608ff.).  It  is  true  that  the  GDPR  recognises  a  limited  "group  privilege"  in  Recital 
48  in  the  context  of  the  legitimate  interests  of  Article  6(1  f)  GDPR.  It  says  controllers 
that  are  part  of  a  group  of  undertakings  or  institutions  affiliated  to  a  central  body  may 
have  a  legitimate  interest  in  transmitting  personal  data  within  the  group  of  undertakings 
for  internal  administrative  purposes,  including  the  processing  of  clients'  or  employees' 
personal  data.  The  European  Data  Protection  Legislation  therefore  for  the  first  time 
expressly  recognises  the  necessity  of  internal  data  transfers  within  groups  of 
companies  and  expressly  emphasises  the  interest  data  controllers  have  in  such 
transfers.  Flowever,  it  is  still  necessary  to  carry  out  a  case-by-case  examination  and  to 
balance  the  legitimate  interests  of  the  company  in  the  intra-group  transfer  of  data  vis- 
a-vis  the  interests  of  data  subjects  in  ensuring  that  their  data  are  not  transferred  within 
groups  of  companies.654 

753  The  data  exchange  possible  under  the  Terms  of  Service  is  not  limited  to  internal 
administrative  purposes  according  to  Facebook's  own  statement  but  serves  mainly 
other  interests.  It  is  not  clear  why  data  processing  of  this  magnitude  is  needed  for 
internal  analytics  purposes.  This  also  applies  to  the  data  that  Facebook  collects  from 
WhatsApp  and  which,  according  to  Facebook655,  is  only  used  for  internal  analytics 
purposes,  for  instance,  to  determine  the  number  of  users.  Apart  from  the  fact  that  this 
statement  is  not  reflected  in  the  Terms  of  Service,  it  is  not  clear  either  why  data  need 
to  be  collected  and  assigned  to  Facebook  user  account  at  Facebook  Ireland  Ltd  in 
order  to  determine  the  number  of  users.  Hamburg’s  Data  Protection  Commissioner 
prohibited  Facebook  Ireland  Ltd.  from  collecting  and  storing  WhatsApp  data  on  the 
basis  of  the  previous  Federal  Data  Protection  Act  (BDSG)  with  judicial  confirmation  and 
made  this  subject  to  the  requirement  of  consent.656 

754  The  asserted  research  interests  are  only  mentioned  in  general  terms  in  the  legal  bases. 
It  is  not  clear  why,  in  addition  to  the  Facebook  data,  the  data  of  other  Facebook-owned 
services  are  absolutely  necessary  for  this  purpose.  The  same  applies  to  the  legal 


654  Voigt,  Konzerninterner  Datentransfer  -  Praxisanleitung  zur  Schaffung  eines  Konzernprivilegs  (available  in 
German  only),  CR  2017,  428  (429). 

655  [  ] 

656  Statement  of  the  Hamburg  Commissioner  for  Data  Protection  and  Freedom  of  Information  of  23  September 
2016,  [...] 
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requests  mentioned  in  the  legal  bases.  In  this  respect,  too,  it  is  not  apparent  why  data 
need  to  be  collected  from  Facebook-owned  services  -  which  are  collected  for  no 
particular  event. 

•  Legitimate  interests  of  third  parties 

755  Pursuant  to  Article  6(1  f)  GDPR,  not  only  the  legitimate  interests  of  Facebook,  but  also 
the  legitimate  interests  of  third  parties  need  to  be  considered  when  balancing  interests. 
In  this  respect,  Facebook  points  out  that  not  only  the  legitimate  interests  of  the 
commercial  partners,  but  also  those  of  the  broader  community  of  Facebook  users  need 
to  be  taken  into  account.  This  would  lend  more  weight  to  Facebook’s  legitimate 
interests.  The  wider  community  of  Facebook  users,  for  instance,  has  a  strong  interest 
in  the  security  and  protection  of  the  Facebook  network  and  in  ensuring  that  other  users 
do  not  abuse  the  network.657 

756  From  the  Bundeskartellamt's  perspective,  in  particular  advertisers  who  want  to  buy 
targeted  advertising  from  Facebook,  as  well  as  other  partners  who  are  active  on  the 
other  market  sides  of  the  personalised  service  Facebook.com,  may  have  legitimate 
interests  as  third  parties.  The  same  applies  to  a  possible  interest  of  the  general  public 
according  to  the  guidelines  issued  by  the  Article  29  Data  Protection  Working  Party.658 
Flowever,  Facebook  users,  who  Facebook  refers  to  in  this  context  as  the  "wider 
community",  are  hardly  to  be  regarded  as  third  parties,  since  the  entire  broad 
community  is  affected  by  data  processing.  They  can  therefore  only  be  taken  into 
account  when  assessing  the  interests  and  rights  of  the  data  subjects.  Flowever,  it  is 
extremely  doubtful  that  the  users  have  to  subordinate  themselves  to  the  community 
interest  defined  by  Facebook  with  regard  to  the  protection  of  their  privacy  and  their  right 
to  self-determination. 

757  All  in  all,  the  interests  of  third  parties  claimed  here  are  identical  to  those  claimed  by 
Facebook  itself.  Therefore  the  same  applies  to  the  question  whether  the  third  parties 
have  the  same  legitimate  interests  as  Facebook.  In  particular,  data  processing  must 
also  be  necessary  for  the  interests  of  third  parties.  This  is  not  the  case  in  view  of  the 
congruence  of  interests  for  data  processing  from  the  Group's  own  services  with  regard 
to  the  interests  of  third  parties  in  personalised  advertising.  Reference  is  made  to  the 
information  above. 

758  Finally,  this  also  applies  to  a  public  interest  in  the  prevention  of  illegal  or  punishable 
acts,  such  as  child  abuse,  frequently  mentioned  by  Facebook.  In  its  guidelines  on 


657  [■■■] 

658  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  36;  [...] 
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legitimate  interests,  the  Article  29  Working  Party  draws  attention  to  situations  in  which 
a  controller  goes  beyond  his  specific  legal  obligations  under  laws  and  regulations  in 
order  to  contribute  to  law  enforcement  or  support  private  actors  in  their  efforts  to  combat 
illegal  activities,  such  as  money  laundering,  grooming  of  children  for  sexual  purposes 
or  illegal  online  file  sharing.  In  such  cases,  however,  in  the  view  of  the  Article  29  Data 
Protection  Working  Party,  it  is  particularly  important  to  ensure  that  the  boundaries  of 
Article  6(1  f)  GDPR  are  fully  respected.  It  is  not  evident  why  intra-group  data  processing 
is  necessary  to  safeguard  this  interest. 

•  Interests  and  rights  of  users 

759  Finally,  the  interests  and  rights  of  the  data  subjects,  in  this  case  Facebook  users,  must 
be  taken  into  account  and  balanced. 

760  This  includes  in  particular  users'  interest  and  right  to  maintaining  their  informational 
self-determination  and  their  privacy.  In  its  opinion  on  legitimate  interests,  the  Article  29 
Data  Protection  Working  Party  also  emphasises  this  in  particular,  since  in  times  of 
increasing  distortions  in  the  field  of  “information  sovereignty”,  in  which  governments 
and  business  institutions  amass  unprecedented  amounts  of  data  on  individuals  and  are 
increasingly  able  to  create  detailed  profiles  predicting  their  behaviour  (thereby 
exacerbating  information  imbalances  and  undermining  personal  autonomy)  it  is  all  the 
more  important  to  ensure  that  the  interests  of  individuals  in  the  protection  of  their 
privacy  and  autonomy  are  safeguarded.659 

761  In  addition,  all  other  relevant  user  interests  that  are  affected  by  data  processing  must 
be  taken  into  account.660  In  this  respect,  Facebook  points  out  that  users'  interest  in 
being  offered  the  most  effective  and  high-quality  service  possible  that  is  free  of  charge 
because  it  is  financed  by  advertising,  must  be  taken  into  account  first  and  foremost.661 
The  Bundeskartellamt  also  regards  this  as  a  legitimate  interest  and  takes  this  into 
account  when  balancing  interests.  Plowever,  Facebook's  statement  does  not  indicate 
that  users  must  be  denied  the  right  to  influence  representation  of  their  own  interests  in 
order  to  be  able  to  use  the  effective  and  high-quality  service  offered  in  their  own  interest 
with  regard  to  the  data  processing  procedures  from  Facebook-owned  services  affected 
here.  In  this  case  too,  data  protection-friendly  alternatives  that  include,  for  instance, 
corresponding  voluntary  options  for  users,  are  not  deemed  necessary. 


659  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  38;  [...] 

660  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  38;  [...] 
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762  And  if  the  user  community  is  to  be  regarded  as  an  interest  group  which  has  an  interest 
in  user  and  network  security  that  needs  to  be  taken  into  account,  it  has  neither  been 
claimed  nor  is  it  apparent  that  data  processing  is  necessary  for  this  interest  for  the 
assessment  under  Article  6(1  f)  GDPR  -  as  outlined  above. 

763  In  all  other  respects,  the  interests  of  the  data  subject  do  not  need  to  be  "legitimate", 
contrary  to  the  interests  pursued  by  the  controller  or  by  a  third  party,  as  highlighted  by 
the  wording  of  Article  6(1  f)  GDPR.  This  means,  for  instance,  that  even  persons  acting 
unlawfully  or  "maliciously"  cannot  be  subject  to  disproportionate  interference  with  their 
rights.662 

ii.  Balancing  of  interests  with  regard  to  the  consequences  for  the  affected 
users 

764  The  legitimate  interests  claimed  by  Facebook  in  the  processing  of  data  from  Facebook- 
owned  services  cannot  outweigh  the  legitimate  interests  and  rights  of  Facebook  users. 

765  Although  Facebook's  commercial  interests  are  relevant  to  fundamental  rights  in  the 
context  of  entrepreneurial  freedom,  this  only  applies  if  it  can  be  assumed  data 
processing  is  necessary  for  interests  allegedly  pursued.663  Flowever,  even  if  it  could  be 
assumed  that  data  processing  was  necessary,  the  data  processing  in  the  Group  is  not 
sufficiently  balanced  pursuant  to  Article  6  (1  f)  GDPR,  considering  how  it  affects  the 
interests  and  fundamental  rights  of  data  subjects. 

766  Contrary  to  Facebook's  view,  "actual"  negative  effects  are  not  the  only  decisive  factor 
here.  In  this  respect,  it  cannot  be  argued  that  the  only  negative  effect  for  users  is  the 
fact  that  advertisements  are  shown  and  that  this,  which  can  at  best  be  described  as  a 
nuisance,  does  not  cause  any  harm.664  On  the  contrary,  Facebook  demonstrates  the 
gross  imbalance  that  exists  between  the  nature  and  extent  of  data  processing  carried 
out  without  users'  consent  and  the  purpose  pursued  by  this,  above  all,  which  is  to 
display  granular  personalised  advertisements  on  a  service  that  is  also  personalised. 

767  According  to  the  guidelines  issued  by  the  Article  29  Data  Protection  Working  Party, 
specifically  foreseeable  adverse  results  are  significant  as  the  term  "consequences" 
used  by  the  Working  Party  is  much  broader  than  "harm"  or  "disadvantage"  for  one  or 
more  specifically  several  data  subjects.  Rather,  this  refers  to  all  possible  (potential  or 


662  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  38  [...] 

663  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  44  [...] 
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219 


actual)  consequences  of  data  processing.665  The  Article  29  Data  Protection  Working 
Party  has  therefore  developed  further  key  factors  for  the  impact  assessment  in  order 
to  identify  and  assess  the  impact  on  the  interests  and  rights  of  data  subjects  and  thus 
the  seriousness  of  the  invasion  of  privacy  and  self-determination.  They  include  in 
particular 

o  the  type  of  data 

o  how  the  data  is  processed, 

o  data  subjects’  justified  expectations  and 

o  the  position  of  the  controller  and  the  data  subjects.666 

768  In  its  Recitals,  the  GDPR  also  emphasised  in  particular  the  "reasonable  expectation  of 
the  data  subjects"  based  on  the  "relevant  and  appropriate  relationship  with  the 
controller". 

769  When  these  key  factors  are  considered  as  a  whole,  the  disadvantageous 
consequences  for  users'  privacy  and  self-determination  outweigh  the  largely  unjustified 
and  therefore  less  important  interests  of  Facebook. 

•  Type  of  data 

770  This  initially  applies  to  the  data  affected  by  intra-group  data  processing,  which  are  to 
be  classified  as  sensitive  data.  This  includes  sensitive  data  because  the  data 
processing  imposed  also  involves  special  categories  of  data,  communication  data  and 
location  data.667  Users  are  also  tracked  across  services  and  devices  as  data  from  all 
corporate  services  are  used,  which  includes  the  particularly  popular  services  WhatsApp 
and  Instagram,  i.e.  the  Facebook  services  involve  a  large  amount  of  sensitive  data. 
The  protection  of  privacy  and  autonomy  takes  on  a  high  priority  in  view  of  the  special 
sensitivity  of  this  data. 

771  Sensitive  data  are  also  affected  in  relation  to  the  individual  services  examined.  All  of 
the  above  data  categories  are  initially  affected  when  data  is  collected  from  the 
Facebook-owned  Oculus  and  Masquerade  services.  In  particular,  these  services 
collect  and  store  a  wide  range  of  device-related  information,  including  location  data. 
This  can  also  easily  affect  special  categories  of  data  generated  from  websites  visited, 
apps  used  and  locations.  As  outlined  above  (584ff.)  it  is  therefore  sufficient  that  this 


665  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  47  [...] 

666  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  43ff.  [...] 

667  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  49. 
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feature  results  indirectly  from  the  data.  In  balancing  interests,  it  must,  however,  also  be 
taken  into  account  that  the  data  is  combined  with  the  user  data  which  Facebook.com 
already  has,  thus  providing  a  full  profile  including  special  data  categories. 

772  WhatsApp  data  are  also  closely  associated  with  the  communication  behaviour  of  users 
which  means  these  data  too  are  potentially  sensitive.  This  holds  true  despite  the 
unclear  information  provided  by  WhatsApp  on  the  extent  to  which  WhatsApp  messages 
are  shared  and  used  and  therefore  completely  vague  wording  of  Facebook's  Terms  of 
Service.  Data  are  also  collected  by  Facebook  Ireland  Ltd.  on  the  type  and  frequency  of 
WhatsApp  features  used.  This  includes  the  communication  contents  of  the  “Status” 
function  in  which  users  can  post  news  about  their  current  activity,  location  etc.  including 
photos  for  all  their  contacts.  This  cannot  be  deemed  “published”  and  therefore  less 
sensitive  since  the  recipients  consistently  comprise  a  limited  group  of  persons. 
Features  also  include  the  telephone  number  and  a  large  number  of  other  device- 
identifying  data  that  ensure  users  can  be  traced  on  the  Internet  and  that  the  data  can 
be  assigned  to  their  Facebook  user  account. 

773  Last  but  not  least,  the  processing  of  personal  data  generated  from  Instagram  involves 
sensitive  data  for  the  most  part.  This  applies  to  all  communication  data  and  contents  of 
users,  contacts,  device-related  information,  location  information,  signal  information,  to 
name  but  a  few.  The  large  volume  of  browser-  and  device-related  data  makes  it 
possible  to  identify  users  and  ensures  they  can  be  tracked  on  the  Internet  even  though 
the  relevant  users  have  no  control  mechanisms. 

774  With  Instagram,  users’  consent  to  the  processing  of  special  data  categories  is 
incidentally  only  obtained  for  data  they  actively  enter  themselves.  Flowever,  data  on 
users’  online  behaviour  are  collected  via  cookies  and  device-related  data,  indicating 
that  this  also  involves  special  data  categories.  Instagram's  Data  Policy  which  is 
identical  to  Facebook’s  Data  Policy  does  not  contain  any  limitations  whatsoever 
regarding  the  use  of  data  for  purposes  pursued  by  Facebook.com  but  describes  the 
services  as  a  shared  offering. 

•  Type  of  data  processing 

775  This  type  of  data  processing  represents  a  serious  invasion  of  the  data  subject's  privacy. 
This  is  because  data  processing  already  reaches  a  very  high  level  in  terms  of  type  and 
quantity  with  the  user-  and  device-related  data  that  Facebook-owned  services  account 
for. 

776  Another  particularly  problematic  aspect  is  that  the  vast  majority  of  the  data  is  collected, 
combined  and  used  for  detailed  profiling  aimed  at  personalising  and  individualising  the 
Facebook.com  service  and  the  ads  displayed.  Although  the  provision  of  a  personalised 
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social  network  may  usefully  involve  profiling,  the  processing  of  data  from  Facebook- 
owned  services  leads  to  a  massive  additional  invasion  of  privacy,  given  that  profiling  is 
supplemented  by  tracking  the  users  concerned  across  a  vast  number  of  websites, 
locations,  devices  and  services.668  To  this  end,  the  data  collected  are  also  used  for  the 
purpose  of  browser  and  device  fingerprinting. 

777  The  investigations  carried  out  by  the  Bundeskartellamt  show  that  the  combination  of 
data  from  Facebook-owned  services  is  of  major  significance  because  [...]  people  use 
Facebook.com  and  Instagram  as  well  as  Facebook.com  and  WhatsApp  in  parallel.  In 
the  first  quarter  of  2018,  more  than  [...]  %  of  the  monthly  and  daily  active  Facebook 
users  were  also  using  WhatsApp  and  more  than  [...]  %  of  the  daily  Facebook  users 
were  also  using  Instagram.  In  addition,  there  are  less  widespread  services,  each  of 
which  is  also  used  in  parallel  to  Facebook.com,  and  there  is  a  high  probability  that 
Masquerade,  for  example,  is  being  used  in  parallel  with  Instagram.  This  makes  it  clear 
that  users  are  tracked  en  masse  across  all  websites,  devices  and  services  used, 
particularly  for  marketing  and  advertising  purposes.  In  any  such  case,  the  Article  29 
Data  Protection  Working  Party  also  thinks  that  this  can  only  be  justified  under  data 
protection  law  by  means  of  voluntary  consent.669 

•  Users’  reasonable  expectations 

778  The  processing  of  data  collected  from  Facebook-owned  services  imposed  does  not 
correspond  to  the  reasonable  expectations  of  data  subjects  based  on  their  relationship 
with  the  controller  either,  which  are  particularly  emphasised  in  Recital  47  of  the  GDPR. 
The  "reasonable"  expectations  users  have  regarding  stricter  confidentiality,  already 
regarded  as  a  key  factor  by  the  Article  29  Data  Protection  Working  Party,  must  be 
assessed  in  particular  on  the  basis  of  the  nature  of  the  relationship  and  on  the  service 
provided.  Contrary  to  the  view  held  by  Facebook670,  it  cannot  be  assumed  with  regard 
to  the  Facebook  Business  Tools  either  that  Facebook.com  users  are  aware  that  a  large 
amount  of  data  from  their  entire  Internet  usage  behaviour  is  assigned  to  their  Facebook 
user  accounts  and  are  used  for  personalisation  and  other  purposes. 

779  For  a  start,  the  relationship  between  users  and  the  various  Facebook  services  is 
determined  in  particular  by  the  log-in  to  the  service-related  account.  At  the  time  the 


668  See  also  Article  29  Data  Protection  Working  Party,  Guidelines  on  Automated  individual  decision-making  and 
Profiling  for  the  purposes  of  Regulation  2016/679,  p.  16;  Article  29  Data  Protection  Working  Party,  Opinion 
06/2014  on  the  notion  of  legitimate  interests  of  the  data  controller  under  Article  7  of  Directive  95/46/EC,  p.  75- 
77,  [...] 

669  See  also  Article  29  Data  Protection  Working  Party,  Guidelines  on  Automated  individual  decision-making  and 
Profiling  for  the  purposes  of  Regulation  2016/679,  p.  16;  Article  29  Data  Protection  Working  Party,  Opinion 
06/2014  on  the  notion  of  legitimate  interests  of  the  data  controller  under  Article  7  of  Directive  95/46/EC,  p.  75- 
77,  [...] 
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data  is  collected  from  the  social  network  by  another  Facebook-owned  service,  such  as 
WhatsApp  or  Instagram,  for  which  users  log  in  with  a  separate  account,  users  need  not 
reasonably  expect  the  data  to  also  be  combined  with  the  Facebook  user  account  and 
to  be  used  for  all  purposes  pursued  by  the  social  network. 

780  No  such  expectation  can  be  derived  solely  from  the  fact  that  the  services  are  part  of 
the  same  group  of  undertakings.  Not  all  users  know  precisely  what  services  belong  to 
Facebook.  This  applies  in  particular  to  lesser-known  services  such  as  Oculus  and 
Masquerade.  Facebook  does  mention  these  services  in  its  Data  Policy.  However,  users 
regularly  only  take  fleeting  notice  of  them  -  as  is  to  be  assumed  with  general  terms  and 
conditions.  In  this  particular  case,  users  must  also  press  a  hyperlink  in  the  Data  Policy 
which  takes  them  to  another  page  listing  the  companies  belonging  to  the  group.  These 
include  in  particular  the  services  WhatsApp  and  Instagram  and  a  large  number  of  other 
companies.671  If  users  click  on  any  of  these  services,  they  are  taken  to  the  terms  of  use 
of  these  services.672  However,  in  order  to  understand  which  of  their  data  is  being 
processed,  users  must  read  the  terms  of  use  of  each  individual  service  in  order  to 
assess  what  data  are  collected  under  that  service  and  are  combined  with  their 
Facebook  usage  data.  The  Article  29  Data  Protection  Working  Party  therefore  rightly 
points  out  that  instead  of  relying  on  the  "small  print",  the  factual  context  must  be  taken 
into  account.673 

781  The  specific  WhatsApp  and  Instagram  services,  by  their  very  nature  and  presentation, 
also  create  an  expectation  of  greater  confidentiality.  This  is  because  Instagram  and 
WhatsApp  are  communication  services  that  regularly  send  content  and  messages  to  a 
narrower  audience  defined  by  the  user.  WhatsApp  also  sends  messages  in  encrypted 
form,  conveying  the  impression  of  a  high  level  of  confidentiality  for  all  other  data.  As  a 
communication  service,  Instagram  also  creates  expectations  as  to  how  any  such  data 
and  contacts  are  handled.  There  is  a  high  level  of  publicity  on  Instagram,  but  this  is  not 
consistent,  as  here  too  users  can  limit  the  circle  of  recipients. 

782  All  things  considered,  the  extent  of  possible  data  processing  from  all  services  of  the 
Facebook  Group  does  not  correspond  to  users'  reasonable  expectations.  This  is 
especially  true  in  view  of  the  fact  that  users  are  unable  to  assess  what  data  are 
processed  on  Facebook  in  which  combination  with  what  meaning  or  what  the 


671  List  of  the  “Facebook  companies”  available  under  https://de-de.facebook.eom/help/1 1 1814505650678  (last 
accessed  on  27  July  2018),  [...] 

672  https://de-de.facebook.com/about/privacv,  [...1,  under  “What  kind  of  information  do  we  collect?":  We  receive 
information  about  you  from  companies  owned  or  operated  by  Facebook  pursuant  to  their  terms  and  policies. 
Learn  more  about  these  companies  and  their  Data  Policies.” 

673  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  51;  [...] 
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assessment  options  are.  Even  if  it  can  be  assumed  that  the  average  Internet  user  can 
reasonably  expect  some  form  of  tracking  to  take  place  with  other  services  for  most 
online  services,  they  need  not  expect  the  level  of  intensity,  which  is  possible  according 
to  the  Terms  of  Service,  nor  need  they  expect  their  data  to  be  continuously  combined 
with  Facebook  user  accounts.674 

•  Position  of  the  controller  and  users 

783  After  all,  Facebook's  position  vis-a-vis  users  means  that  the  need  for  protection  against 
the  massive  invasion  of  privacy  associated  with  internal  data  processing  within  the 
Group  is  particularly  high  and  must  take  precedence  over  Facebook's  interests.  As  a 
multinational  company  with  a  dominant  position  in  the  market,  Facebook  has  the 
negotiating  power  to  impose  extensive  data  processing  unilaterally  on  users. 

784  According  to  the  opinion  of  the  Article  29  Data  Protection  Working  Party,  the  dominant 
position  must  definitely  be  taken  into  account  in  respect  of  the  balancing  of  interests.  It 
is  important  to  consider  whether  the  controller  is  an  individual,  a  smaller  organisation, 
a  large  multinational  or  a  public  body.  Depending  on  the  particular  circumstances 
involved,  its  position  may  be  more  or  less  dominant  in  relation  to  the  data  subject.  A 
large  multinational  may,  for  instance,  have  more  resources  and  bargaining  power  than 
the  individual  data  subject;  it  may  therefore  be  in  a  better  position  to  impose  on  the 
data  subject  what,  in  its  view,  is  in  his  or  her  “legitimate  interests”.  This  may  be  all  the 
more  true  if  the  company  holds  a  dominant  position  in  the  market.  Just  as  consumer 
protection  and  competition  law  help  to  ensure  that  this  power  is  not  abused,  data 
protection  law  can  also  play  an  important  role  in  ensuring  that  the  rights  and  interests 
under  data  protection  law  are  linked  to  the  assessment  of  abuse  under  antitrust  law.675 

785  On  this  basis,  it  is  obvious  that  Facebook  has  a  monopoly-like  position  on  the  market 
for  social  networks  in  this  particular  case  (see  para.  374ff.)  and  that  the  scope  it  has  for 
data  processing  gives  it  special  bargaining  power,  meaning  it  can  assert  its  interests 
unilaterally.  Facebook's  statement  also  shows  that  the  company  imposes  unilaterally 
on  users  what  it  considers  to  be  in  their  "legitimate  interest".  Facebook,  for  example, 
repeatedly  emphasises  in  its  submission  that  the  personalisation  and  individualisation 
of  the  service  and  advertising  are  in  the  users'  interest  and  that  users  benefit  from 
them.676  It  is  also  evident  from  shifting  the  legal  basis  from  the  provision  of  the  service 
subject  to  consent  to  the  alleged  necessity  for  the  extensive  contractual  objects 
unilaterally  imposed  by  Facebook  in  the  Terms  of  Service  that  the  company  is  making 


674  cf.  Harting,  General  Data  Protection  Regulation,  para.  437 

675  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  51;  [...] 
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extensive  use  of  the  existing  scope  for  negotiation  and  data  processing  in  order  to 
pursue  its  own  interests.  Facebook  does  not  accord  users  the  right  of  self- 
determination  over  their  own  interests  regarding  processing  within  the  Group.  It  must 
also  be  taken  into  consideration,  as  outlined  above,  that  intra-group  data  processing 
from  other  services  involves  the  risk  of  further  strengthening  Facebook’s  market  power 
vis-a-vis  users  by  transferring  this  market  power  to  other  services  -  Instagram  in 
particular  -  by  spying  out  user  behaviour  in  the  case  of  competitive  offers  in  order  to 
ward  off  aggressive  competition.  This  would  strengthen  the  bargaining  power  and  the 
possibility  of  imposing  data  processing  terms  unilaterally. 

786  It  must  also  be  taken  into  consideration  in  relation  to  Facebook’s  dominant  position  in 
the  market  that  the  majority  of  persons  using  Facebook.com,  Instagram  and  WhatsApp 
but  also  Masquerade  are  adolescents  or  young,  inexperienced  people  who  frequently 
have  no  reservations  about  and  have  full  faith  in  online  services  and  are  unable  to 
assert  their  interests  vis-a-vis  a  multinational  undertaking  that  has  a  dominant  position 
in  the  market.  An  online  study  conducted  by  the  broadcasting  corporations  ARD/ZDF 
in  2017  showed  that  14  to  19-year-olds  (90  percent  of  all  respondents)  make  up  the 
largest  group  of  WhatsApp  users  followed  by  14  to  29-year-olds  (87  percent  of  all 
respondents).  In  the  group  of  30  to  49-year-olds,  only  72  percent  of  the  respondents 
are  still  using  the  service;  41  percent  of  50  to  69-year-olds  and  13  percent  of  the  over 
70s  said  they  were  using  WhatsApp.677  The  number  of  under-1 9-year-olds  using 
Instagram  is  also  rising  sharply.  Around  37  percent  of  Instagram  users  are  aged 
between  14  and  29.  Instagram  is  showing  a  strong  growth  trend.  Whereas  Instagram 
had  around  9  million  users  in  Germany  in  2016,  the  number  of  users  had  risen  to  15 
million  by  2017.  According  to  public  statistics,  the  strongest  growth  trend  is  among  the 
group  of  14-19-year-olds  at  16  percent.678 

iii.  Lack  of  protective  measures 

787  And  last  but  not  least,  Facebook  has  neither  claimed  nor  is  there  any  evidence  to 
suggest  that  additional  protective  measures  have  been  taken  in  relation  to  the 
processing  of  data  collected  from  Facebook-owned  services  in  a  bid  to  create  a  fair 
balance  of  interests. 

788  As  such,  it  is  initially  about  observing  the  so-called  horizontal  provisions  set  forth  in  the 
GDPR  consisting  in  general  data  protection  obligations,  inter  alia,  regarding 


677  http://www.ard-zdf-onlinestudie.de/files/2017/Artikel/917  Koch  Frees.pdf  (last  accessed  on  10  January  2019), 
p.444. 

678  https://www.crowdmedia.de/social-media/instaaram-nutzerzahlen-in-deutschland-2018/  (in  German,  last 
accessed  on  1 0  January  201 9). 
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transparency  and  proportionality.679  However,  this  does  not  mean  that  in  itself  it  is 
always  sufficient  to  observe  these  horizontal  requirements  in  order  to  ensure 
processing  is  necessary  for  the  purposes  of  legitimate  interests  pursuant  to  Article  6  (1 
f)  GDPR.  Rather,  in  cases  in  which  it  is  not  clear  which  legitimate  interests  are 
overriding,  additional  measures  that  extend  beyond  observance  of  the  horizontal 
requirements  may  need  to  be  taken  in  order  to  balance  interests.  According  to  the 
guidelines  issued  by  the  Article  29  Data  Protection  Working  Party,  one  of  these 
additional  measures  could,  for  instance,  be  providing  a  user-friendly,  accessible 
mechanism  that  would  enable  the  data  subjects  to  object  unreservedly  to  the 
processing  of  their  data.680 

789  The  Article  29  Data  Protection  Working  Party  also  points  out  technical  and 
organisational  measures  for  ensuring  that  the  data  cannot  be  used  for  measures 
associated  with  individuals  ("functional  separation"),  increased  use  of  anonymisation 
systems,  aggregation  of  data,  technologies  for  strengthening  privacy,  privacy  by 
design,  assessing  the  consequences  for  privacy  and  data  protection,  increased 
transparency,  a  general,  unconditional  right  to  refuse  data  processing,  data  portability 
and  similar  measures. 

790  On  this  basis,  the  Bundeskartellamt  sees  in  this  case  no  relevant  data  processing  in 
which  the  balance  of  interests  is  unclear.  On  the  contrary,  on  the  basis  of  the  key  factors 
outlined  above,  there  is  a  gross  imbalance  between  the  extent  of  data  processing  and 
the  largely  non-legitimate  interests  of  Facebook.  Another  aspect  worth  noting  in  this 
case  is  that  there  is  no  evidence  that  protective  measures  have  been  taken  in 
connection  with  the  processing  of  data  collected  from  Facebook-owned  services.  From 
the  Decision  Division’s  perspective,  this  shows  that  the  horizontal  requirements  are  not 
being  met  either. 

791  This  applies  in  particular  to  the  transparency  obligation  regulated  in  Article  5  (1  a) 
GDPR  with  regard  to  the  processing  of  data  collected  from  Facebook  Business  Tools, 
which  also  applies  to  the  extent  to  which  personal  data  are  processed  and  will  continue 
to  be  processed  in  the  future.  The  principle  of  transparency  also  presupposes  that  all 
information  and  messages  on  the  processing  of  these  personal  data  are  given  in 
transparent,  intelligible  and  easily  accessible  form,  using  clear  and  plain  language.681 


679  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  52;  [...] 

680  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  53;  [...] 

681  cf.  Recital  37  GDPR. 
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792  The  Data  Policy  governing  Facebook-owned  services  provides  some  information  about 
the  collection  and  processing  of  data  for  the  purposes  of  Facebook.com.  However,  it 
takes  several  clicks  to  access  this  information  and  it  is  not  provided  in  Facebook's  Data 
Policy  itself.  Users  need  to  switch  back  and  forth  between  the  Data  Policies  in  order  to 
receive  information  about  all  of  the  data  Facebook  combines  with  Facebook-owned 
services.  It  is  not  clear  from  WhatsApp’s  Data  Policy  either  to  what  extent  WhatsApp 
messages  are  used  to  enhance  the  product  experience  on  Facebook.com.  Instagram 
does  not  provide  any  information  about  the  extent  to  which  data  are  used  for 
Facebook.com.  In  this  respect,  mutual  reference  is  made  to  the  same  general  formula 
which  says  that  data  are  processed  across  the  Facebook  Companies. 

793  There  are  no  user-friendly  options  available  enabling  users  to  object  to  the  processing 
of  data  from  Facebook-owned  services.  It  is  even  hard  for  users  to  exercise  their  right 
to  object  to  the  processing  of  their  data  based  on  Article  6  (1  e)  and  If)  GDPR  pursuant 
to  Article  21  GDPR  in  this  case  since  it  is  unclear  in  the  legal  bases  published  by 
Facebook  what  data  processing  procedures  are  based  on  what  legal  basis.  All 
objections  -  with  the  exception  of  minors  -  can  be  refuted  according  to  Facebook’s 
Terms  of  Service  by  claiming  data  processing  is  necessary  for  performance  of  the 
contract. 

794  There  do  not  seem  to  be  any  provisions  governing  retention  periods  or  any  other  data 
minimisation  measures.  Unlike  Facebook  partners,  users  do  not  even  have  the  option 
of  disabling  targeted  advertising  regarding  data  collected  from  Facebook-owned 
services.  There  are  therefore  no  mechanisms  available  whatsoever  that  give  users 
effective  control  over  the  cross-service  combination  of  their  data.682  In  this  respect, 
Facebook  merely  points  out  that  users  are  not  compelled  to  use  the  services  of 
Facebook  Companies.  In  addition,  Facebook  even  states  in  the  present  proceedings 
that  refraining  from  using  Facebook  is  the  only  reasonable  response  for  users  who  do 
not  wish  to  avail  themselves  of  a  personalised  service.  Facebook  therefore  explicitly 
rejects  the  possibility  of  self-determination  and  control  on  the  part  of  users. 

795  Facebook's  legal  bases  only  refer  to  protective  measures  for  minors,  which,  however, 
only  relate  to  one  aspect  of  the  consideration  and  ultimately  cannot  be  used  as 
justification  for  data  processing  from  other  services  that  are  not  absolutely  necessary 
for  the  purpose  indicated. 


682  cf.  in  this  context  also  example  26  provided  by  the  Article  29  Data  Protection  Working  Party,  Opinion  06/2014 
on  the  legitimate  interests  of  the  data  controller  pursuant  to  Article  7  of  Directive  95/46/EC  ,  p.  86  [...] 
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(b)  Facebook  Business  Tools 

796  On  the  basis  of  the  principles  outlined  above,  the  collection  and  combination  of 
personal  data  from  third-party  websites  and  apps  that  use  Facebook  Business  Tools 
offered  by  Facebook,  is  not  justified  pursuant  to  Article  6  (1  f)  GDPR. 

797  The  data  processing  imposed  by  third-parties  via  Facebook  Business  Tools  is  for  the 
most  part  not  covered  by  legitimate  interests  since  it  has  neither  been  clearly  articulated 
nor  it  is  necessary  (see  i.).  In  weighing  up  the  consequences  for  the  users  concerned, 
the  key  factors  that  need  to  be  considered  are  the  interest  and  right  of  users  to  the 
protection  of  their  privacy  and  autonomy  (see  ii.).  No  protective  measures  have  been 
implemented  so  far  that  strike  a  fair  balance  of  interests  (see  iii.). 

i.  Legitimate  interests 

798  Facebook  has  for  the  most  part  failed  to  clearly  articulate  legitimate  interests  that  might 
be  considered  necessary  for  data  processing  via  Facebook  Business  Tools  to  the 
extent  possible  according  to  the  Terms  of  Service. 

•  Facebook’s  interests 

799  The  personalisation  goals  pursued  by  Facebook.com  and  invoked  in  the  present  case 
in  relation  to  the  processing  of  data  collected  from  Facebook  Business  Tools,  including 
targeted  advertising,  measurement  and  analytics  purposes,  user  and  network  security, 
as  well  as  the  provision  of  "accurate  and  reliable  reporting  to  our  advertisers, 
developers  and  other  partners,  to  ensure  accurate  pricing  and  statistics  on 
performance  and  to  demonstrate  the  value  that  our  partners  realise  using  Facebook 
Company  Products”,683  may,  in  principle,  represent  legitimate  interests  under  Article 
6(1  f)  GDPR.  Flowever,  as  outlined  above,  the  key  issue  is  whether  the  legitimate 
interest  has  been  sufficiently  clearly  articulated  to  weigh  up  the  balance  of  interests  and 
whether  legitimate  interests  apply  in  the  present  situation.  Facebook  has  not  clearly 
articulated  its  interests  although  it  is  required  to  do  so  nor  is  it  assumed  in  relation  to 
the  individual  Facebook  Business  Tools  that  data  processing  is  necessary  in  the  first 
place. 

o  Legitimate  interests  have  not  been  articulated  clearly  enough 

800  In  the  present  proceedings,  Facebook  merely  states,  as  explained  above,  that  the  data 
processing  carried  out  by  Facebook,  including  the  processing  of  data  collected  from 
Facebook  Business  Tools,  was  not  only  necessary  for  the  performance  of  the  contract, 
but  was  also  justified  by  Facebook’s  overriding  interests.  Facebook  says  it  had  a 
legitimate  interest  in  processing  data  also  from  third-party  sources  for  the  purpose  of 


683  Facebook  legal  bases,  https://www.facebook.com/about/privacv/leaal  bases.  [...] 
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personalising  its  service  and  for  advertising  and  analytics  purposes  in  order  to 
safeguard  financing  of  the  service.  Furthermore,  it  says  the  collection  and  processing 
of  data  from  third-party  sources  was  indeed  justified  by  legitimate  interests  in  so  far  as 
they  serve  to  promote  network  and  user  security.  Facebook  claims  data  processing  for 
security  purposes  was  essential  in  order  to  guarantee  general  operability. 

801  The  processing  of  data  collected  from  Facebook  Business  Tools  is  justified  in  the  legal 
bases  published,  as  outlined  above  (para.  631),  in  addition  to  the  necessity  for  the 
performance  of  the  contract  and  consent  to  the  use  for  personalised  advertising,  with 
the  provision  of  measurement  and  analytics  services  as  a  legitimate  interest,  but  only 
to  the  extent  to  which  Facebook  is  the  data  controller.  The  Facebook  Business  Tools 
Terms  provide,  as  outlined  above  (para.  136),  that  Facebook  processes  data  on  behalf 
of  the  controller  although  this  has  not  been  effectively  agreed  upon,  in  order  to  measure 
the  effectiveness  of  advertisements  and  Facebook  Analytics  through  the  use  of  the 
Facebook  pixel,  SDKs  or  other  interfaces.  This  assigns  sole  data  responsibility  to  the 
third-party  providers  for  the  purposes  of  providing  campaign  reports  and  analyses  and 
providing  insight  into  customers  and  their  use  of  apps,  websites,  products  and  services. 

802  Facebook  also  invokes  a  legitimate  interest  in  "providing  accurate  and  reliable  reporting 
to  our  advertisers,  developers  and  other  partners,  to  ensure  accurate  pricing  and 
statistics  on  performance  and  to  demonstrate  the  value  that  our  partners  realise  using 
Facebook  Company  Products”  in  its  legal  bases  for  the  processing  of  data  collected 
from  the  same  tools  and  regarding  "other  business  services".  The  Facebook  Business 
Tools  Terms  indicate  in  Paragraph  5  iii-v  that  Facebook  uses  the  data  collected  via  the 
Facebook  Business  Tools  consistently  for  personalisation  purposes,  security  aspects, 
and  research  and  development  purposes  and  to  improve  Facebook  products.684  Under 
the  Facebook  Platform  Policy,  which  Facebook  also  refers  to,  Facebook  is  given  the 
option  of  analysing  the  third-party  website  and  app  specifically  indicating  "We  can 
analyze  your  app,  website,  content,  and  data  for  any  purpose,  including  commercial” 
when  using  social  plugins,  for  example.685 

803  Even  this  statement  by  Facebook  does  not  represent  a  sufficiently  clear  articulation  of 
the  legitimate  interests  that  could  be  used  to  balance  the  interests  and  rights  of  data 
subjects.  For  Facebook  does  not  specifically  substantiate  its  own  interests  -  such  as 
the  content  or  relevance  of  “pricing”  or  “performance  statistics”  for  any  of  the  above- 


684  https://www.facebook.com/leqal/technoloav  terms,  [...] 

685  see  Paragraph  7.1  to  3  of  Facebook  Platform  Policy,  https://developers.facebook.com/policv/:  “Things  you 
should  know:  7. 1:  We  can  analyze  your  app,  website,  content,  and  data  for  any  purpose,  including  commercial”, 
7.2:  We  can  monitor  or  collect  data  related  to  your  use  of  SDKs;  7.3:  We  will  use  information  we  receive  from 
you  or  in  connection  with  your  Platform  integration  pursuant  to  our  Data  Policy.  (...).“,  [...] 
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mentioned  services  nor  does  it  provide  a  differentiated  explanation  as  to  why  data 
needs  to  be  collected  from  the  various  Facebook  Business  T ools  or  why  the  data  needs 
to  be  assigned  to  Facebook  user  accounts  for  these  purposes.  Facebook  does  not 
explain  the  type  of  data  processing  involved  either,  in  particular  the  profiling  used  to 
personalise  the  service  and  for  advertising  purposes  or  indeed  what  contribution  the 
data  collected  from  Facebook  Business  Tools  makes. 

804  Rather,  Facebook  declares  once  again  for  all  Facebook  Business  Tools,  both  in  its 
statements  in  the  present  proceedings  and  in  its  various  related  policies,  that  all  data 
processing  is  possible  and  necessary  for  a  variety  of  generally  defined  legitimate 
interests. 

o  The  data  processing  imposed  is  not  necessary 

805  It  cannot  be  assumed  in  relation  to  Facebook  Business  Tools  based  on  the 
investigations  carried  out  by  the  Bundeskartellamt  that  the  extent  of  data  processing 
possible  under  the  Terms  of  Service  and  the  data  processing  actually  implemented  are 
necessary  for  the  above-mentioned  purposes. 

806  As  outlined  above  (para.  139ff.)  the  integration  of  Facebook  Business  Tools  gives 
Facebook  direct  access  to  comprehensive  data  about  users  and  their  usage  behaviour 
from  the  respective  providers  who  use  Facebook  services.  A  "Like"  button,  the  "Share" 
or  the  "Facebook  Login"  button  shows  users  that  Facebook  Business  Tools  have  been 
embedded.  Flowever,  the  interface  does  not  necessarily  have  to  be  visible  to  users,  as 
is  usually  the  case,  for  example,  when  the  Facebook  pixel  is  embedded  on  the  website 
in  the  measurement  and  analytics  tools. 

807  In  the  opinion  of  the  Bundeskartellamt,  no  data  flow  is  necessary  at  all  or  to  the  extent 
imposed  and  practiced  when  users  access  the  website  or  app  without  being  able  to 
exercise  any  control.  This  data  does  not  need  to  be  assigned  to  the  respective 
Facebook  user  account  or  used  for  the  interests  and  purposes  asserted  by  Facebook. 

Social  plugins 

808  This  applies  first  and  foremost  to  the  social  plugins,  which  enable  Facebook  users  to 
communicate  directly  with  their  network  on  Facebook  from  third-party  websites  or  apps. 
On  the  opposite  (market)  side,  Facebook  gives  the  operators  of  websites  or  apps  the 
opportunity  to  increase  their  own  reach  through  advertising  by  using  plugins  which 
promote  the  website  on  Facebook.com.  What  is  more,  third  companies  can  use  the 
Facebook  analytics  product  "Sharing  Insight"  to  obtain  information  about  the  websites' 
performance  on  Facebook.com  when  users  click  the  "Like"  of  "Share"  button.  They 
make  it  possible  to  track  user  activities  on  the  website  and  the  URL  of  the  previously 
visited  website. 
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809  The  provision  of  a  "Like"  or  "Share"  button  or  any  other  social  plugin  for  Facebook  users 
and  third  party  companies  does  not  (see  above  703),  require  any  data  flow  to  Facebook 
about  the  use  of  the  website  unless  the  user  interacts  with  the  button.  Only  when  the 
user  clicks  on  the  button  does  a  certain  data  record  become  necessary,  which  enables 
data  to  be  assigned  to  the  Facebook  user  account  under  which  it  is  to  be  distributed  on 
Facebook.com.  Only  then  are  the  measurement  and  analytics  purposes  of  the  social 
plugins  affected.  The  analytics  product  "Sharing  Insights",  which  is  crucial  in  this 
respect,  requires  the  user  to  interact  with  the  plugin  in  order  to  trigger  measurable 
communication  on  Facebook.com.  The  fact  that  a  social  plugin  has  been  embedded 
does  not  imply  the  simultaneous  use  of  measurement  and  analytics  products  within 
Facebook  Analytics  or  the  use  of  advertisements  on  Facebook.  There  is  hence  no 
reason  to  assume  it  is  necessary  for  the  functionalities  of  social  plugins. 

810  Facebook  cannot  justify  direct  access  to  data  on  third-party  websites  and  apps,  in 
addition  to  the  above-mentioned  interests  and  purposes,  with  the  fact  that  it  can  keep 
the  plugin  technically  up-to-date  without  any  need  for  the  third-party  websites  or  apps 
to  do  anything.  It  is  not  clear  to  what  extent  a  large  amount  of  data  assigned  to  the 
Facebook  user  account  about  user  behaviour  on  a  third-party  website  needs  to  flow 
each  time  a  user  accesses  the  website.  The  same  applies  to  the  direct  data  flow  to 
Facebook  without  a  detour  via  the  embedded  website  or  app.  Facebook  cannot  claim 
that  this  prevents  third-party  websites  and  apps  from  receiving  the  personal  data 
Facebook  obtains  through  the  data-combining  process.686  No  protective  function  is 
discernible  in  view  of  the  data  collected  and  used  by  Facebook  for  its  own  commercial 
purposes,  which  are  not  necessary  for  the  purposes  of  the  functionality  for  users  or 
third-party  providers. 

81 1  Nor  do  the  other  social  networking  purposes  mentioned  in  the  Data  Policy  and  in  the 
various  documents  referred  to  for  which  this  data  can  be  used  indicate  the  extent  to 
which  additional  extensive  data  collection  is  necessary  for  an  unlimited  number  of 
websites  and  apps  via  social  plugins  and  why  this  cannot  already  be  achieved  with  the 
extensive  data  processing  on  Facebook.com  itself.  The  same  applies  to  security  and 
research  purposes.  In  this  respect,  reference  is  made  to  the  statement  on  Facebook- 
owned  services  (see  above  para.  750ff.).  To  claim  it  is  useful  for  the  purposes  of  the 
social  network  -  as  outlined  above  -  is  not  sufficient. 

Facebook  Login  and  Account  Kit 

812  Data  processing  via  the  Facebook  Login  and  Account  Kit  when  accessing  the  website 
or  app  without  the  user  having  to  press  the  button  is  not  required  either  for  the  purposes 

686  j  ] 
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indicated  by  Facebook.  Essentially  the  same  considerations  apply  as  for  the  social 
plugins. 

813  This  is  because  the  functionality  of  these  interfaces  is  essentially  identical:  Third-party 
websites  may  offer  a  "Facebook  Login"  on  their  site  that  enables  users  to  log  in  to  the 
website  using  their  Facebook  registration  data  or  by  entering  their  mobile  phone 
number  or  e-mail  address  (so-called  "Account  Kit").687  This  means  that  users  do  not 
have  to  register  with  a  new  login  name  and  password  each  time  they  sign  up  with  a 
website.  Users  can  also  transfer  personal  data  to  the  app  to  avoid  having  to  create  a 
new  user  profile  when  they  sign  up  with  a  new  website  or  app. 

814  By  integrating  the  Facebook  Login,  Facebook  offers  the  following  advantages  to 
websites  or  apps:  First  of  all,  embedding  the  Facebook  Login  makes  it  easier  to  attract 
new  users  who  can  register  quickly  and  easily  on  the  respective  website/app.688  One 
particular  advantage  for  companies  is  that  users  log  on  to  Facebook.com  using  their 
"real  identity"  and  not  under  a  pseudonym.689  The  Facebook  Login  also  gives  the  third- 
party  website/app  access  to  additional  usage  data.  This  means  the  website/app  has 
access  to  the  "public  profile",  the  primary  e-mail  address  and  the  users’  list  of  friends690 
as  well  as  about  30  additional  pieces  of  user  information  after  going  through 
Facebook’s  internal  "review  process”.  Facebook  advertises  the  "Facebook  Login" 
product  on  the  Internet  so  that  the  company  can  collect  information  about  the  user  that 
would  otherwise  „be  complex  or  arduous  to  collect  via  your  own  registration  form”.691 

815  Furthermore,  the  Facebook  login  can  be  combined  with  other  functionalities,  in 
particular  various  other  social  plugins  and  the  so-called  “Graph  API”  due  to  the 
requirement  of  the  Facebook  SDK  (also  for  websites  in  the  form  of  the  SDK  for 
JavaScript).  The  latter  allows  third-party  providers  to  access  Facebook's  so-called 
"social  graph".  This  comprises  all  the  user  data  stored  on  the  Facebook  servers  as  well 


687  [■■■] 

688  https://developers.facebook.com/docs/facebook-loqin/overview/.  [...],  cf.  “Cross-platform  login:  Facebook  Login 
is  available  on  the  most  popular  platforms  for  mobile  and  desktop  apps.  Users  who  create  accounts  on  a  platform 
via  Facebook  can  also  quickly  and  easily  log  into  their  app  on  another  platform.  Individuals  always  have  the 
same  user  ID  anywhere,  ensuring  a  seamless,  cross-platform  app  experience.  Facebook  Login  is  available  for 
iOS,  Android,  Web  and  Windows  Phone,  for  desktop  apps  and  for  Smart-TVs,  Internet  of  Things  objects  and 
similar  devices." 

689  https://developers.facebook.com/docs/facebook-login/overview/ ,  [...] 

690  See  under  https://developers.facebook.com/docs/facebook-lcgin/overview/.  [...]:  “Social  Many  highly  retentive 
apps  let  people  connect  with  their  friends  in  order  to  enable  shared  in-app  experiences.  Facebook  Login  lets 
you  know  which  of  your  app's  users  are  also  friends  on  Facebook  so  you  can  build  value  by  connecting  people 
together.” 

691  See  under  https://developers.facebook.com/docs/facebook-loqin/overview/.  [...]:  “Personalized experiences  are 
more  engaging  and  lead  to  higher  retention.  Facebook  Login  lets  you  access  information  which  would  be 
complex  or  arduous  to  collect  via  your  own  registration  form.,  for  instance  what  users  have  marked  with  “Like” 
in  relation  to  birthdays,  hometowns,  current  places  of  residence  or  careers.  Even  just  importing  someone's 
profile  picture  imported  from  Facebook  gives  them  a  stronger  sense  of  connection  with  your  app.  ” 
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as  their  relationships  and  interactions.  Third-party  providers  can  include  data  from  the 
social  graph  in  their  web  service  or  app,  such  as  "Likes"  or  ratings.  The  third  party  may 
also  write  data  into  the  social  graph.  This  occurs  in  particular  when  users  perform 
"social  actions"  with  the  third-party  provider,  such  as  sharing,  commenting  or  -  for 
instance  in  the  case  of  social  games  -  posting  certain  actions  for  Facebook  friends. 

816  Similar  to  social  plugins,  by  integrating  the  Facebook  Login,  Facebook  receives 
information  from  third-party  websites/apps  about  the  websites/apps  Facebook  users 
have  registered  with  and  users’  interaction  with  each  website/app.  It  also  receives 
browser  and  device-related  information.  As  such,  it  is  just  as  unnecessary  for  the  user 
to  activate  the  Facebook  Login  to  initiate  a  data  flow  as  it  is  for  the  social  plugins.  For 
a  start,  the  volume  of  data  that  Facebook  currently  receives  is  the  same  as  for  social 
plugins.  According  to  Facebook,  the  company  also  receives  the  login  information  which 
users  enter  directly  and  manually  -  without  using  the  Facebook  Login  -  on  the  website 
of  the  provider  who  has  the  Facebook  Login  embedded.692 

817  The  provision  of  a  convenient  login  functionality  for  Facebook  users,  as  with  the  use  of 
social  plugins,  as  shown  above,  (para.  703)  does  not  require  any  data  flow  to  Facebook 
about  the  use  of  the  website  or  even  the  users’  registration  data  unless  the  user  clicks 
the  button.  Only  when  the  user  clicks  the  button  does  a  limited  data  record  need  to  be 
sent  to  Facebook  for  the  login  data  to  be  transmitted  to  the  website.  The  integration  of 
a  Facebook  Login  does  not  imply  the  use  of  measurement  and  analytics  products  within 
Facebook  Analytics  or  the  use  of  advertisements  on  Facebook  either.  There  is  hence 
no  reason  to  assume  a  data  flow  not  controlled  by  the  user  is  necessary  for  the 
functionalities  of  the  Facebook  Login  or  Account  Kit. 

81 8  Also  the  other  social  networking  purposes  mentioned  in  the  Data  Policy  and  the  various 
referenced  documents  for  which  this  data  may  be  used  do  not  indicate  the  extent  to 
which  additional  data  collection  is  required  for  an  unlimited  number  of  websites  and 
apps  via  the  Facebook  Login  and  Account  Kit  and  why  this  cannot  already  be  achieved 
by  the  extensive  data  processing  on  Facebook.com  itself.  The  same  applies  to  security 
and  research  purposes.  In  this  respect,  reference  is  once  again  made  to  the  statement 
on  Facebook’s  own  suite  of  services  (see  above  para.  750ff.). 

Pixel  and  SDK-based  measurement  and  analytics  services 

819  In  relation  to  the  measurement  and  analytics  services  offered  on  the  basis  of  the 
Facebook  pixel  and  SDKs,  the  extensive  data  processing  that  takes  place  involving  the 
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assignment  of  the  data  collected  back  to  the  respective  Facebook  user  account  is  not 
necessary  either  for  the  pursuit  of  legitimate  interests. 

820  For  a  start,  as  explained  above,  the  pixel  is  used  to  send  the  data  record  of  the  “http 
header”  collected  during  the  integration  of  each  interface  to  Facebook.  When  the 
website  is  accessed,  a  standard  web  protocol  is  created  by  default  that  includes  IP 
addresses,  information  about  the  web  browser,  page  location,  document,  referrer  (the 
web  page  from  which  the  user  has  accessed  the  current  website),  and  the  person  using 
the  website.  Facebook  records  the  “pixel-specific  data”  via  the  pixel,  including  the  pixel 
ID  and  the  Facebook  cookie  once  the  pixel-base  code  is  implemented.  Facebook  also 
receives  "click  data"  for  buttons  ("button-click  data")  by  default,  namely  any  buttons 
clicked  by  site  visitors,  the  labels  of  those  buttons  and  any  pages  visited  as  a  result  of 
the  button  clicks.693 

821  In  addition,  the  website  operator  can  configure  certain  user  actions  ("Events")  regarding 
the  use  of  the  third-party  website  or  app.  In  this  case,  Facebook  receives  additional 
information  about  user  behaviour  on  third-party  websites  and  apps.694  The  pre¬ 
configured  fifteen  "Standard  Events"  include  information  about  a  purchase  made  on 
the  website,  a  registration,  the  placing  of  goods  in  the  shopping  cart  or  a  search  query 
made  by  the  user.695  Depending  on  the  website  operator's  wishes,  further  "event  types" 
can  be  configured  in  addition  to  these  standard  events,  for  instance  information  on 
whether  the  user  has  scrolled  down  to  the  end  of  a  page  or  how  many  articles  have 
been  read  in  a  session.696  As  soon  as  a  user  takes  corresponding  action,  this  is 
recorded  by  Facebook  and  is  assigned  to  the  Facebook  user  account  via  identifiers. 
Facebook  then  provides  the  website  operator  with  aggregated  analyses  of  its  target 
group.697 

822  If  -  as  with  mobile  apps  -  the  analytics  functions  are  implemented  via  the  SDK,  similar 
data  is  captured  by  Facebook.  This  includes  the  Facebook  app  ID,  the  mobile 
advertising  ID  and  other  metadata  such  as  the  device-related  ID,  the  SDK  version,  app 
information,  IP  address  and  other  device-related  information.698  By  integrating  the  SDK, 
certain  event  types  are  automatically  logged  unless  the  app  operator  has  deactivated 
this  setting.  These  preset  events  (“Automatically  Logged  Events”)  include  "App  Install" 


693  https://de-de.facebook.com/business/learn/facebook-create-ad-app-install-enqaqement,  [...] 

694 

695  https://de-de.facebook.com/business/help/402791 146561 655?helpref=faq  content:  standard  events:  Add  to 
cart,  Add  Payment  Info,  Add  To  Wishlist,  Complete  Registration,  Contact,  Customize  Product,  Donate,  Find 
Location,  Initiate  Checkout,  Lead,  Purchase,  Schedule,  Search,  Start  Trial,  Submit  Application. 

696  https://developers.facebook.com/docs/facebook-pixel/advanced.  L..1 

697  See  https://de-de.facebook.com/business/help/8981 855602321 80?helpref=faq  content,  [...] 
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(data  about  the  first  time  a  user  activates  an  app),  "App  Launch”  (data  about  the  launch 
of  an  app)  and  "In-App-Purchase"  (data  about  the  purchase  of  a  product  via  the  app).699 
In  addition  to  these  preset  events,  the  app  operator  can  also  configure  additional  app 
"Event"  types,  so-called  “Explicit  Events”.  Here,  users  can  choose  from  a  wide  range 
of  event  types:  These  events  can  be  data  about  an  app  being  launched,  payment  data 
being  added,  a  level  being  reached  (e.g.  in  an  online  game),  goods  being  placed  in  the 
shopping  cart  or  added  to  a  wish  list,  a  registration  or  tutorial  being  completed,  a 
purchase  being  started  or  completed,  a  rating  being  given,  a  product  being  searched 
for,  credits  being  issued,  a  success  being  achieved  or  a  content  being  displayed.700 
The  App  Operators  can  add  the  above-mentioned  Events  in  order  to  receive  analytics 
data  about  user  actions  within  their  app  or  website. 

823  This  extremely  extensive  data  collection,  and  in  particular  the  assignment  of  data  to 
Facebook  user  accounts,  is  for  the  most  part  not  necessary  for  Facebook's  own 
purposes  and  interests. 

824  In  this  respect,  Facebook  has  argued  in  the  present  proceedings  that  701 

j-  ]702|-  ]  703  [  ]  704 

825  The  need  for  narrow  interpretation  of  the  term  also  suggests  the  data  collection  and 
assignment  to  the  respective  Facebook  user  account  are  not  necessary  as  otherwise 
the  conclusion  could  be  drawn  that  all  data  processing  from  all  sources  would  be 
necessary  for  the  personalisation  of  ads.  The  argument  that  the  data  processing 
imposed  is  necessary  in  order  to  effectively  display  personalised  ads  [. .  .],705  cannot  be 
used  as  a  generalisation  to  explain  why  data  processing  is  necessary.  The  fact  that 
Facebook  makes  use  of  data  collected  from  Facebook  partners  for  personalised 
advertising  conditional  on  users'  consent  mitigates  against  this.  It  is  not  clear  why  the 
collection  of  data  and  assignment  to  Facebook  user  accounts  should  nevertheless  be 
necessary  for  the  personalisation  of  ads,  even  if  the  respective  users  do  not  consent 
to  the  use  of  the  data  for  this  purpose.  The  high  reach  that  Facebook  has  due  to  its 
user  base  and  the  analysis  possibilities  that  exist  based  on  the  use  of  the  social  network 
alone  are  a  sufficient  basis  for  displaying  targeted  advertising  and  measuring  the 


699  https://develoDers.facebook.com/docs/apD-events/autornatic-event-collection-detail,  [...] 

700  https://developers.facebook.com/docs/app-events/best-practices  with  numerous  examples  of  configurable  apps 
for  the  e-commerce,  retail,  travel  and  gaming  industries,  [...] 
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success  of  advertising  and  are  in  fact  seen  as  one  of  the  main  attractions  of  Facebook's 
advertising  network.706 

826  Insofar  as  measurement  and  analytics  services  are  offered  independently  of  paid 
advertising,  the  collection  of  data  on  third-party  websites  and  assignment  to  Facebook 
user  accounts  as  stipulated  in  the  Terms  of  Service  are  not  necessary  either.  In  order 
to  provide  analytics  services,  data  on  user  behaviour  must  of  course  be  collected  and 
evaluated  on  the  websites  and  apps  to  be  analysed.  It  is  not  necessary  for  the  provision 
of  any  such  service  to  give  access  to  the  entire  database  on  the  social  network’s  users 
with  which  the  data  are  collected  and  combined.  In  fact,  personal  data  are  not  even 
needed  for  the  reports  and  statistics  produced  and  provided  by  measurement  and 
analytics  services.  Even  the  market  leader  Google  Analytics  offers  website  owners  the 
possibility  of  anonymising  the  IP  addresses  of  its  users.  In  this  case,  only  an 
abbreviated  version  of  the  user's  IP  address  is  transmitted  to  Google  Analytics,  which 
does  not  enable  Google  Analytics  to  identify  individual  users.707 

827  Moreover,  in  the  case  of  measurement  and  analytics  services,  the  required  data  largely 
depend  on  the  individual  needs  of  the  users  of  these  services,  so  that  such  analytics 
services  are  ultimately  subject  to  consent  to  effective  processing  on  behalf  of  the 
controller,  in  which  only  the  website  or  app  as  the  data  controller  can  determine  in  detail 
the  extent,  type  and  intended  use  of  the  data  by  the  provider.  Plere,  too,  reference  is 
made  to  Google  Analytics,  which,  following  consultation  with  the  data  protection 
authorities,  can  only  offer  the  service  in  the  form  of  processing  on  behalf  of  the 
controller  and  in  the  context  of  which  anonymisation  can  be  arranged.708 

828  Processing  on  behalf  of  the  controller  has  not  been  effectively  agreed  in  the  case  of 
Facebook.  This  cannot  be  replaced  by  a  legitimate  interest  in  the  provision  of  analytics 
services,  which  is  intended  to  require  virtually  unlimited  collection  and  combination  of 
data  with  other  data  from  all  other  Facebook-owned  services. 

829  The  other  social  networking  purposes  listed  in  the  Data  Policy  and  the  various 
referenced  documents  for  which  this  data  may  be  used,  do  not  indicate  the  extent  to 
which  additional  data  processing  is  necessary  for  an  unlimited  number  of  websites  and 
apps  via  the  Facebook  pixel  or  SDKs  and  why  this  cannot  be  achieved  with  the 
extensive  data  processing  on  Facebook.com  itself.  The  same  applies  to  security  and 


706  [...] 

707  see  https://support.qooqle.com/analytics/answer/27630527hken;  [...] 

708  https://www.lfd.niedersachsen.de/themen/internet/aooale  analvtics/aooale-analvtics-hinweise-fuer-website- 

betreiber-in-niedersachsen-98936.html  (last  accessed  on  1 0  January  201 9). 
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research  purposes.  In  this  respect,  reference  is  once  again  made  to  the  statement  on 
Facebook’s  own  suite  of  services  (see  above  para.  741  ff.). 

•  Legitimate  interests  of  third  parties 

830  Also  to  be  included  in  the  balancing  of  interests  are  the  legitimate  interests  of  the 
advertisers,  developers  and  websites  integrating  Facebook  Business  Tools  and  whose 
interests  Facebook  invokes,  particularly  in  the  legal  bases  published.  Accordingly, 
Facebook  also  bases  the  provision  of  measurement,  analytics  and  other  corporate 
services  on  the  “interest  of  advertisers,  developers  and  other  partners  to  help  them 
gain  insights  about  their  customers  and  improve  their  businesses ,  validate  our  pricing 
models  and  evaluate  the  effectiveness  of  their  online  content  and  advertising  in  and 
outside  of  Facebook  companies’  products”. 

831  Hence,  as  already  indicated  with  regard  to  Facebook-owned  services,  the  interests  of 
third  parties  at  least  partially  overlap  with  those  of  Facebook,  so  that  the  massive  extent 
of  data  processing  possible  under  the  Terms  of  Service  for  private  users  through 
intensive  web  tracking  via  a  vast  number  of  websites  and  apps  with  comprehensive 
recording  of  user  behaviour  and  the  assignment  to  Facebook  user  accounts  cannot  be 
covered  by  the  legitimate  interests  of  third  parties  either. 

832  According  to  the  investigations  carried  out  by  the  Bundeskartellamt,  however,  this 
extent  of  data  processing  also  runs  counter  to  the  interests  of  third  parties  in  respect  of 
Facebook  Business  Tools.  This  is  because  the  tools  do  not  allow  them  to  fully  control 
the  extent  of  data  processing  and  the  level  of  data  protection  they  impose  on  their  own 
website  visitors  or  app  users  when  they  use  Facebook  Business  Tools.  At  the  same 
time,  however,  the  Terms  of  Service  require  the  users  of  Facebook  Business  Tools  to 
provide  the  legal  basis  for  the  disclosure  and  use  of  customer  data.  When  using  the 
pixel  or  SDKs,  the  website  or  app  is  required  to  display  a  stable  and  sufficiently  visible 
notice  providing  a  minimum  amount  of  information  about  data  processing.709  However, 
those  using  Facebook  Business  T ools  can  only  determine  the  extent  of  data  processing 
to  a  very  limited  degree.  This  applies  both  to  the  Facebook  data  collected  via  the 
interfaces  and  to  the  assignment  of  data  to  Facebook  user  accounts  and  the  use  of  any 
such  for  Facebook’s  business  purposes. 

833  This  means  the  users  of  social  plugins  and  the  Facebook  Login  cannot  prevent  data 
from  flowing  to  Facebook  even  if  visitors  to  the  website  do  not  press  the  buttons.  The 
only  exception  is  the  “Like”  button,  for  which  the  so-called  “two-click  solution”  was 
developed  by  third-party  providers,  where  either  just  an  icon  of  the  button  is  initially 


709  https://www.facebook.com/leqal/technoloav  terms,  [...] 
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displayed  and  a  connection  is  not  established  with  Facebook  until  the  second  click,  or 
a  hyperlink  takes  users  to  a  separate  page  and  only  there  is  the  “Like”  button  integrated. 
This  is  far  less  convenient  for  visitors  and  Facebook  users.  There  is  no  alternative 
solution  available  for  other  social  plugins. 

834  With  regard  to  the  use  of  the  Facebook  pixel  and  SDKs  for  measurement  and  analytics 
purposes,  third  parties  have  a  particular  interest  in  function  designs  that  are  permitted 
under  data  protection  law  and  in  the  option,  for  example,  as  part  of  effective  processing 
on  behalf  of  the  controller  or  at  least  by  concluding  individual  agreements  as  joint 
controllers  pursuant  to  Article  26  para.  1  sentence  2  GDPR,  of  being  able  to  (co- 
jdetermine  the  extent  of  data  processing  themselves.710 

•  Interests  and  rights  of  users 

835  Finally,  the  interests  and  rights  of  users  must  be  taken  into  account.  In  this  respect, 
users’  interest  in  and  right  to  the  protection  of  informational  self-determination  and  their 
privacy  are  also  paramount  here.  All  other  relevant  legitimate  interests  of  users  must 
also  be  taken  into  account.  Reference  is  made  to  the  statement  on  Facebook-owned 
services  (para.  759ff.)  above. 

ii.  Balancing  of  interests  with  regard  to  the  consequences  for  the  affected 
users 

836  Based  on  the  nature  of  the  data  and  data  processing,  and  Facebook’s  reasonable 
expectation  and  position  vis-a-vis  users,  the  interests  and  rights  of  users  with  regard  to 
their  privacy  and  autonomy  ultimately  also  outweigh  Facebook’s  interests  in  the 
processing  of  data  collected  from  Facebook  Business  Tools  that  are  already  less 
important  because  they  are  not  necessary.  They  also  outweigh  the  interests  of  third 
parties  insofar  as  they  coincide  with  the  interests  of  Facebook. 

•  Type  of  data 

837  This  initially  applies  to  the  data  affected  by  the  processing  of  data  collected  from 
Facebook  Business  Tools,  which,  like  data  from  Facebook-owned  services,  also 
include  sensitive  data. 

838  This  includes  sensitive  data  because  the  data  processing  imposed  also  involves 
special  categories  of  data,  device-identifying  data  and  location  data.  The  extensive 
harvest  of  browser  and  device-related  data  makes  it  possible  to  identify  users,  ensuring 
they  can  be  fully  traced  on  the  Internet,  while  the  users  concerned  have  virtually  no 
control  mechanisms.  By  integrating  Facebook  Business  Tools,  users  are  tracked 
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across  all  services  and  devices  in  addition  to  the  Facebook-owned  services,  so  that  a 
significant  amount  of  sensitive  data  is  affected  out  of  all  the  data  collected  and  assigned 
via  the  identifying  device-related  information.711 

839  Through  the  mass  integration  of  Facebook  Business  Tools  and  APIs  such  as  social 
plugins,  Facebook  Login  or  the  Facebook  pixel,  Facebook  collects  and  processes 
special  data  categories.  The  flirting  app  "Tinder",  for  instance,  offers  a  Facebook  login 
and  the  homosexual  partner  exchange  "Queer"  (www.queer.de)  has  an  integrated 
“Share”  on  Facebook  button.  Even  political  parties  such  as  CDU,  SPD,  Linke  and  AfD 
and  healthcare  websites  such  as  www.onmeda.de  or  www.netdoctor.de  have 
integrated  “Share”  on  Facebook  buttons. 

840  Furthermore,  data  processing  can  include  users’  purchasing  behaviour,  transaction 
data  and,  ultimately,  on  their  financial  resources.  This  enables  Facebook,  which  has 
further  information  about  users  based  on  its  existing  data  record,  to  create  detailed 
profiles  even  for  particularly  sensitive  user  data. 

841  The  protection  of  privacy  and  autonomy  takes  on  a  high  priority  in  view  of  the  special 
sensitivity  of  this  data. 

•  Type  of  data  processing 

842  In  addition,  the  type  of  data  processing  performed  via  Facebook  Business  Tools 
represents  a  serious  invasion  of  data  subjects’  privacy. 

843  The  intensity  of  web  tracking  is  completely  disproportionate  to  the  legitimate  purposes 
pursued  by  Facebook  because  it  involves  detailed  tracking  of  a  significant  proportion 
of  users’  Internet  behaviour. 

844  The  total  number  of  Facebook  Business  Tools  embedded  in  Germany  runs  into  the 
high  millions.  The  Bundeskartellamt  questioned  Facebook  about  the  integration  of 
individual  interfaces  into  the  100  most  visited  websites  and  apps. 

845  Facebook  provided  high  integration  numbers,  pointing  out  that  these  may  be  incorrect 
due  to  referrer  spoofing.  Of  the  100  most  visited  websites  in  Germany  in  spring  2018 
[...]  had  a  “Like”  button  or  a  “Share”  button,  at  least  on  their  subpages  and  in  many 
cases  even  on  their  homepage.  Over  [...]  of  the  100  most  visited  websites  had  an 
integrated  Facebook  pixel.712 


711  cf.  also  the  Court  of  First  Instance  Brussels,  judgment  handed  down  on  16  February  2018,  p.  69,  English 
translation,  [...]  (in  relation  to  non-Facebook  users):  “ Moreover ,  the  extent  of  the  violations  in  question  is  massive 
(. . .)  the  number  of  websites  that  contain  Facebook  social  plugins  amounts  to  several  million,  rendering  them 
practically  unavoidable.  The  Information  In  question  is  frequently  of  a  very  sensitive  nature,  allowing,  for 
example,  health-related,  religious,  sexual  and  political  preferences  to  be  gauged.  (...)” 
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846  Because  it  had  been  pointed  out  that  the  information  might  be  incorrect,  the 
Bundeskartellamt  checked  the  respective  homepage  and  some  subpages  of  the  most- 
visited  websites  for  visible  “Like”,  “Share”  and  “Page”  button  interfaces.  Despite  the  fact 
that  not  all  subpages  were  fully  browsed,  approximately  75  percent  of  the  pages  turned 
out  to  have  one  of  the  above-mentioned  interfaces  embedded.  Hence,  most  of  the  data 
provided  by  Facebook  is  accurate.  On  this  basis,  the  Bundeskartellamt  assumes  that, 
of  the  1 00  most  frequently  visited  websites  in  Germany,  around  [. . .]  have  integrated  at 
least  one  of  the  interfaces  on  their  homepage  or  subpages. 

847  Another  particularly  problematic  aspect,  as  with  Facebook-owned  services,  is  that  the 
majority  of  the  data  is  used  for  the  purposes  of  personalisation  and  individualisation  of 
the  Facebook.com  service  and  covers  the  displayed  ads,  -  also  by  enabling  active 
fingerprinting  -and  is  used  for  the  detailed  profiling  that  takes  place  in  this  respect.713 
This  leads  to  a  massive  additional  invasion  of  privacy,  since  profiling  tracks  the  affected 
users  via  an  immense  number  of  websites  and  apps,  and  the  captured  data  is 
combined  both  with  the  data  from  Facebook-owned  services  and  with  the  Facebook 
user  data.714 

•  Users’  reasonable  expectations 

848  The  processing  of  data  collected  from  Facebook  Business  Tools  imposed  does  not 
correspond  to  the  reasonable  expectations  of  the  data  subjects  either  based  on  their 
relationship  with  the  controller,  which  are  particularly  emphasised  in  Recital  47  of  the 
GDPR.  Contrary  to  the  view  held  by  Facebook715,  it  cannot  be  assumed  with  regard  to 
the  Facebook  Business  Tools  that  Facebook.com  users  are  aware  that  a  large  amount 
of  data  from  their  entire  Internet  usage  behaviour  is  being  assigned  to  their  Facebook 
user  account  and  used  for  other  purposes. 

849  For  users  need  not  reasonably  expect  that  when  visiting  websites  or  installing  and 
opening  an  app  with  Facebook  Business  Tools  embedded,  Facebook  will  gain  direct 
access  to  a  large  amount  of  user  and  device-related  data  flowing  to  Facebook  that  is 
assigned  to  their  Facebook  user  account  in  order  to  use  the  data  for  the  social 
network’s  own  purposes. 


713  See  also  German  Data  Protection  Conference  (Datenschutzkonferenz,  DSK),  Short  Paper  No.  3  on  the 
processing  of  personal  advertising,  current  as  of  29  June  2017,  accessible  at  https://datenschutz- 
hamburq.de/paqes/kurzpapiere-dsqvo/,  p.  2:  “More  intrusive  measures  such  as  profiling  rather  suggest  that  the 
data  subject’s  interest  in  the  exclusion  of  data  processing  is  overriding”. 

714  See  also  Article  29  Data  Protection  Working  Party,  Guidelines  on  Automated  individual  decision-making  and 
profiling  for  the  purposes  of  Regulation  2016/679,  p.  16;  Article  29  Data  Protection  Working  Party,  Opinion 
06/2014  on  the  notion  of  legitimate  interests  of  the  data  controller  under  Article  7  of  Directive  95/46/EC,  pp.  75- 
77. 
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850  Users  cannot  expect  the  data  flow  if  only  because  it  already  occurs  the  first  time  they 
visit  the  website  or  open  the  app,  where  often  users  have  no  way  of  telling  if  the  website 
has  integrated  an  interface.  Even  after  that,  they  can  only  tell  this  if  they  see  a  button 
as  in  the  case  of  social  plugins  or  the  Facebook  Login.  However,  the  Facebook  pixel  is 
usually  not  visible  to  users.  This  also  applies  if  it  is  made  visible  as  a  graph,  because 
the  average  user  will  not  be  able  to  recognise  the  meaning  of  the  graph. 

851  The  specific  design  of  the  social  plugins  and  the  Facebook  Login,  which  significantly 
influences  the  relationship  with  users  and  visitors,  also  creates  the  expectation  that  no 
direct  connection,  including  any  data  flow,  is  established  with  Facebook  unless  the 
button  is  pressed.  Thus,  the  buttons  present  a  significant  risk  of  being  misleading.  This 
applies,  in  particular,  to  the  Facebook  Login,  where  the  registration  data  manually 
entered  by  users  is  recorded  even  when  they  do  no  press  the  button.  Hence,  this  can 
already  be  regarded  as  data  processing  undertaken  in  bad  faith.716 

852  Furthermore,  when  the  Login  button  is  pressed,  users  must  above  all  expect  data  to 
flow  from  Facebook  to  the  website  or  app  that  they  are  about  to  log  into  using  their 
Facebook  data.  Only  after  the  button  has  been  pressed  can  a  data  flow  from  the 
website  or  app  to  Facebook  also  be  expected  for  the  transfer  of  login  data,  requiring 
assignment  to  the  Facebook  user  account.  Even  if  the  Facebook  Login  is  linked  to  other 
social  plugins  and  the  Graph  API,  users  will  only  expect  data  to  flow  to  Facebook  if  the 
corresponding  “social  actions”  are  triggered  on  the  website  or  in  the  app. 

853  In  terms  of  the  integration  of  the  Facebook  pixel  and  SDKs,  when  visiting  a  third-party 
website  or  app,  users  need  not  reasonably  expect  their  usage  behaviour  to  be  tracked 
online  and  assigned  to  their  Facebook  account  to  this  extent  for  all  of  the  social 
networking  purposes  pursued  by  Facebook  involving  comprehensive  data  collection. 
Nor  can  this  be  assumed  to  be  part  of  the  relationship  between  Facebook  and  its  users 
given  that  the  social  network  is  financed  by  advertising.  The  Bundeskartellamt  is  also 
of  the  opinion  that  users  must  generally  expect  their  interactions  with  advertising  on 
Facebook  to  be  tracked  and  used  for  advertising  products  when  using  an  advertising- 
funded  service.  However,  this  does  not  automatically  refer  to  behaviour  off 
Facebook.com  or  to  actions  that  are  not  carried  out  at  the  time  the  advertising 
displayed.  Nor  does  the  expectation  include  the  data  being  assigned  to  Facebook  user 
accounts  for  all  social  networking  purposes. 

854  Insofar  as  the  Facebook  pixel  and  SDKs  are  used  without  reference  to  an 
advertisement  for  measurement  and  analytics  services,  there  is  no  relationship  at  all 


7,6  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  56;  [...] 
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between  Facebook.com  and  users  that  would  justify  the  expectation  of  extensive  data 
processing  and  assignment  to  Facebook  user  accounts  or  indeed  any  processing  of 
personal  data  at  all. 

855  Users  should  not  expect  data  records  obtained  via  the  Facebook  pixel  to  be  assigned 
to  Facebook  user  accounts  by  transferring  a  hashed  data  set  -  for  instance  as  part  of 
advanced  matching.  Based  on  its  own  description  of  the  Facebook  pixel,  Facebook 
uses  this  option  even  if  no  cookie  has  been  set.  If  no  cookies  have  been  set,  any  such 
data  collection  and  user  tracking  takes  place  contrary  to  the  expectations  of  Facebook 
users  who  have  blocked  cookies  and  thus  objected  to  web  tracking.  The  same  applies 
to  the  comprehensive  browser  and  device-related  information  that  allows  users  to  be 
tracked  and  identified  without  cookies. 

856  Even  if  users  have  deselected  “Ad  T racking”  for  personalised  advertising  in  the  settings 
of  their  mobile  device,  nothing  else  can  apply.  In  this  case,  users  can  assume  that  the 
advertising  ID  for  measurement  and  analytics  services  aimed  at  enhancing  the 
efficiency  of  personalised  advertising,  will  no  longer  be  used.  Users  cannot  reasonably 
expect  Facebook  to  continue  collecting  the  advertising  ID  throughout,  merely  adding 
the  information  that  users  have  disabled  ad  tracking. 

857  After  all,  the  millions  of  times  Facebook  Business  Tools  are  integrated  on  German 
websites  also  exceeds  users’  reasonable  expectations  regarding  the  amount  of  web 
tracking  that  generally  takes  place  on  the  Internet.  It  is  reasonable  to  assume  that  the 
average  user  can  expect  Internet  use  to  involve  a  certain  amount  of  web  tracking.  In 
the  opinion  of  the  Bundeskartellamt,  however,  it  exceeds  expectations  that  a  single  visit 
to  the  social  network  Facebook.com,  setting  cookies  or  collecting  the  advertising  ID 
and  browser  and  device-related  data  that  takes  place  in  the  process  will  actually  result 
in  the  user  being  tracked  by  Facebook  on  millions  of  other  third-party  websites  or  apps 
in  Germany  alone  and  the  user  data  on  Facebook  being  combined  with  an  ID  used. 

•  Facebook’s  position  vis-a-vis  users 

858  Finally,  Facebook's  position  vis-a-vis  users  means  that  the  need  for  protection  against 
the  massive  invasion  of  privacy  associated  with  the  processing  of  data  collected  from 
Facebook  Business  Tools  is  particularly  high  and  must  take  precedence  over 
Facebook's  interests.  As  a  multinational  company  with  a  dominant  position  in  the 
market,  Facebook  has  the  relevant  bargaining  power  to  impose  extensive  data 
processing  unilaterally  on  users  via  Facebook  Business  Tools.  The  need  for  protection 
is  also  evident,  as  already  mentioned  above  in  relation  to  Facebook-owned  services, 
in  view  of  Facebook's  monopoly-like  position  and  the  scope  of  data  processing,  which 
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Facebook  also  reserves  in  its  Data  Policy  with  regard  to  the  Facebook  Business  Tools. 
Reference  is  made  to  the  information  above  (para.  785). 

859  In  addition,  Facebook's  dominant  position  in  the  market  means  that  data  processing 
from  a  variety  of  sources  cannot  be  prevented  simply  by  switching  social  networks. 
This  is  because  market  dominance  means  that  there  are  not  sufficient  alternatives 
available  to  switch  to  another  provider.  Users  would  therefore  have  to  refrain  from  using 
other  Facebook-owned  services  as  well  as  from  visiting  websites  if  they  did  not  want  to 
add  any  additional  data  to  their  extensive  Facebook  database. 

860  This  applies  only  to  the  extent  to  which  users  are  aware  that  this  level  of  data 
processing  is  implemented  via  Facebook  Business  Tools.  If  users  were  to  try  to  prevent 
this,  it  would  mean  that  Facebook  users  would  practically  have  to  stop  using  the 
internet,  given  the  unpredictable  millions  of  times  the  tools  have  been  integrated  into 
German  websites. 

iii.  Lack  of  protective  measures 

861  In  connection  with  the  processing  of  data  collected  from  Facebook  Business  Tools, 
contrary  to  Facebook's  claim717,  there  are  currently  no  protective  measures  in  place  to 
achieve  a  fair  balance  of  interests.  The  Bundeskartellamt  also  points  out  with  regard  to 
Facebook  Business  Tools  that  no  such  case  exists  which  is  unclear  with  regard  to  the 
question  of  balance.  On  the  contrary,  on  the  basis  of  the  key  factors  outlined  above, 
there  is  a  gross  imbalance  between  the  extent  of  data  processing  at  the  expense  of 
users'  self-determination  and  the  largely  non-legitimate  interests  of  Facebook.  The 
interest  third  parties  have  in  controlling  data  processing  in  relation  to  visitors  to  their 
websites  and  apps  also  needs  to  be  taken  into  account. 

862  It  is  therefore  also  important  to  note,  with  regard  to  data  processing  via  Facebook 
Business  Tools,  that  no  adequate  protective  measures  are  currently  in  place.  To  what 
extent  the  "clear  history  functionality"  announced  [...]  by  Facebook  is  capable  of 
balancing  interests,  including  the  interests  of  third  parties,  is  very  questionable  and  can 
remain  open  here  as  it  has  not  yet  been  implemented. 

863  From  the  Bundeskartellamt's  point  of  view,  the  horizontal  provisions  are  not  being 
complied  with  either  in  relation  to  Facebook  Business  Tools.  This  applies  first  of  all  to 
the  transparency  obligation  regulated  in  Article  5  (1  a)  GDPR  with  regard  to  the 
processing  of  data  collected  from  Facebook  Business  Tools,  which,  as  described 
above,  also  exists  with  regard  to  the  extent  to  which  personal  data  are  processed  and 
will  continue  to  be  processed  in  the  future.  Facebook  points  out  in  the  Data  Policy  under 
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the  heading  "Information  from  partners"  that  data  is  processed  via  Facebook  Business 
Tools  and  explicitly  mentions  the  “Like”  button  and  Facebook  Login.  The  Cookies  Policy 
also  refers  to  the  use  of  cookies  in  connection  with  the  Facebook  Business  Tools, 
specifically  the  social  plugins.  However,  this  only  indirectly  indicates  that  data 
processing  takes  place  even  when  these  buttons  are  not  pressed  (whether  or  not  users 
have  a  Facebook  account  or  are  logged  in). 

864  What  is  problematic  in  this  context  is  the  unclear  assignment  of  data  processing  to  the 
legal  bases  invoked.  Facebook  makes  some  of  the  processing  of  data  collected  from 
Facebook  Business  Tools  dependent  on  consent  whereas  other  elements  of  data 
processing  are  attributed  both  to  Article  6(1  b)  GDPR  and  Article  6(1  f)  GDPR.  This  also 
only  applies  if  Facebook  perceives  itself  as  the  data  controller,  meaning  that  it  remains 
unclear  to  users  what  rights  they  have.  In  particular,  there  is  little  point  in  advising  users 
that  they  can  object  to  their  data  being  processed  if  Facebook  then  argues  that  data 
processing  is  either  necessary  for  contractual  performance  or  that  Facebook  is  not  the 
data  controller. 

865  Users  do  not  have  any  other  control  mechanisms  to  prevent  the  collection  and 
combination  of  data  from  Facebook  Business  Tools.  In  particular,  the  possibility  users 
have  of  using  the  relevant  browser  settings  to  prevent  Facebook  cookies  from  being 
set  and  thus  data  from  being  assigned  to  their  Facebook  user  account  cannot  be 
deemed  an  effective  control  mechanism.  This  is  already  true  because  cookies  are  only 
assigned  to  websites,  but  not  to  mobile  apps  where  the  data  is  assigned  via  the 
advertising  ID.  This  type  of  assignment  cannot  be  effectively  prevented  as  outlined 
above  (para.  656ff.),  since  the  advertising  ID  is  collected  anyway  and  users  can  be 
identified  even  if  the  advertising  ID  is  reset. 

866  Moreover,  a  browser  setting  that  can  only  block  the  Facebook  cookies  for  all  possible 
uses  would  also  eliminate  or  at  least  impair  users'  ability  to  use  the  social  plugins.  As 
outlined  above,  Facebook  points  this  out  in  very  general  terms  in  the  last  sentence  of 
its  Cookies  Policy:  “Certain  parts  of  the  Facebook  Products  may  not  work  properly  if 
you  have  disabled  browser  cookie  use’’ .  Users  would  deprive  themselves  of  the  "Like" 
and  "Share"  functions  of  the  interface,  which,  according  to  Facebook,  does  not  work 
unless  it  can  be  assigned  unequivocally  to  Facebook  user  accounts  via  cookies.  From 
the  users'  point  of  view,  it  is  not  apparent  either  that  although  disabling  cookies 
prevents  the  assignment  to  Facebook  user  accounts  via  the  user  ID,  it  does  not  prevent 
the  data  flow  as  such,  which  could  also  be  assigned  in  other  ways  -  for  instance  through 
advanced  matching  or  device  fingerprinting. 
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867  There  are  currently  no  privacy  settings  either  -  as  Facebook  itself  indicates  -  that  enable 
users  to  control  the  collection  of  data  on  third-party  websites  via  Facebook  Business 
Tools  or  the  combination  of  data  with  Facebook  user  accounts.718  The  reference  to  the 
possibility  users  have  to  opt  out  of  the  use  of  this  data  for  the  purposes  of  personalised 
advertising719,  is  not  sufficient  here.  As  explained  above,  this  refers  only  to  the  use  of 
data  for  personalised  advertising  and  is  limited  to  displaying  advertising  to  user.  It  does 
not  exclude  the  collection,  combining  or  use  of  the  data. 

868  The  newly  introduced  possibility  for  third-party  websites  to  delay  data  collection  by 
Facebook  until  the  third-party  provider  has  obtained  the  users'  consent,720  does  not 
represent  a  sufficient  control  mechanism  for  users.  Facebook  itself  is  responsible  for 
the  data  processing.  Users'  consent  vis-a-vis  third-party  providers  cannot  justify  data 
processing  by  Facebook.  Third  parties  do  not  have  sufficient  insight  into  the  data 
processing  procedures  that  Facebook  performs  in  relation  to  Facebook  Business 
Tools.  Since  the  data  flows  directly  to  the  Facebook  servers,  third-party  providers  are 
unable  to  identify  the  amount  of  data  collected  or  how  the  data  is  combined  and  used. 
There  is  no  point  in  referring  the  third-party  providers  obtaining  consent  unless  effective 
data  processing  on  behalf  of  the  controller  is  involved.  Flowever,  this  is  not  the  case 
here  (see  above  para.  61 7ff.). 

869  There  is  no  evidence  that  any  other  measures  have  been  taken  such  as  technical  or 
organisational  measures  like  separating  Facebook  Analytics  from  the  operation  of  the 
social  network. 

(c)  Outcome  of  the  balancing  of  interests 

870  In  the  final  analysis,  there  is  a  gross  imbalance  between  the  interests  of  Facebook,  only 
some  of  which  are  legitimate,  and  the  protection  of  users’  fundamental  rights  when 
processing  data  from  Facebook-owned  services  and  Facebook  Business  Tools, 
especially  when  a  holistic  view  is  taken.  The  interests  of  third  parties  are  not  taken  into 
account  when  data  is  processed  from  Facebook  Business  Tools  either.  As  a  result, 
Article  6(1  f)  GDPR  cannot  be  invoked  as  a  legal  basis  for  the  processing  of  data 
collected  from  Facebook-owned  services  or  Facebook  Business  Tools. 


718  [..■] 
719  [..■] 
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245 


4.  Infringement  as  a  manifestation  of  market  power 

87 1  These  data  processing  conditions  are  also  abusive  within  the  meaning  of  Section  1 9(1 ) 
GWB.  In  the  present  case,  their  agreement  and  practice  are  the  result  of  Facebook's 
special  market  power,  which  gives  rise  to  the  anti-competitive  effects  (see  (a)  above). 
At  the  same  time,  it  is  clear  that  they  are  to  be  regarded  as  abusive  when  taking  into 
account  all  interests  and  the  objective  of  the  Act  on  Restraints  of  Competition,  which  is 
aimed  at  promoting  free  competition.  Even  if  a  more  far-reaching  balancing  of  interests 
was  required  under  antitrust  law,  the  conclusion  would  be  the  same  as  an  assessment 
under  the  relevant  provisions  of  data  protection  law  (see  b.). 

a.  “Manifestation  of  market  power”  and  causality 

872  According  to  the  review  concept  of  the  case  law  of  the  Federal  Court  of  Justice  on  the 
Supplementary  Pensions  Agency  for  Federal  and  Lander  Employees  ( VBL)  the 
prerequisite  that  the  violation  of  legal  adequacy  provisions  "must  take  place  as  a 
manifestation  market  power  or  a  great  superiority  of  power"  is  a  sufficient  condition  for 
linking  an  objective  accusation  of  abuse  under  antitrust  law  to  the  violation  of  antitrust 
law  norms;  it  can  be  inferred  from  the  wording  "in  particular"  in  the  relevant  Federal 
Court  of  Justice  rulings  that  the  Federal  Court  of  Justice  has  deliberately  refrained  from 
making  the  "manifestation"  clause  a  necessary  prerequisite  for  any  allegation  of  abuse 
under  antitrust  law.721  If  the  prerequisite  is  met,  it  provides  sufficient  evidence  to  make 
the  infringement  of  non-antitrust  regulations  simultaneously  subject  to  antitrust  law  by 
the  required  reference  to  market  power.  At  the  same  time,  however,  this  feature  does 
not  constitute  a  more  far-reaching  requirement  than  the  wording  of  Section  1 9(1 )  GWB 
which  refers  to  the  "abuse"  of  a  dominant  market  position. 

873  Contrary  to  Facebook's  argument,  the  required  link  with  market  power  is  therefore  not 
to  be  construed  within  the  meaning  of  a  strict  causality  of  market  power,  requiring  proof 
that  data  processing  conditions  could  be  formulated  in  such  a  way  precisely  and  solely 
because  of  market  power.722  For  the  "abuse"  of  a  dominant  market  position,  according 
to  general  rules,  it  is  sufficient  for  there  to  be  “normative  causality"  between  market 
dominance  and  the  conduct.723  It  is  sufficient  if  the  conduct  proves  to  be  anti- 


721  Federal  Court  of  Justice,  decision  of  6  November  201 3  -  KZR  58/1 1 ,  VBL  Gegenwert  /;  Federal  Court  of  Justice, 
judgment  of  24  January  201 7  -  KZR  47/1 4  para.  35  (juris). 

722  [■■■] 

723  Fuchs  in  Immenga/Mestmacker,  GWB,  5th  edition  2014,  Section  19  para.  82b;  further  details  on  the  prohibition 
to  demand  unjustified  benefits  from  suppliers  (“Anzapfverbot”)  Section  19  (1),  (2)  no.  5  GWB:  not  even  normative 
causality  required  according  to  Federal  Court  of  Justice,  decision  of  23  January  2018,  KVR  3/17,  WuW  2018, 
209  para.  81 , 83ff.  -  Wedding  discounts. 
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competitive  as  a  result  of  market  dominance,  which  does  not  require  strict  causality  but 
rather  a  causality  in  relation  to  the  outcome.724 

874  In  the  VBL  Gegenwert  //judgment,  the  Federal  Court  of  Justice  indicated  in  its  guiding 
principle  that  inappropriate  terms  and  conditions  which  make  it  more  difficult  to 
terminate  a  long-term  contractual  relationship  with  a  norm  addressee  of  Section  19(1) 
GWB  regularly  constitute  abuse  of  market  power.725  This  clearly  refers  to  the  potential 
effect  of  the  clause  in  connection  with  market  power.  The  Federal  Court  of  Justice  did 
not  consider  it  necessary  to  examine  whether  competitors  are  using  a  similar  clause. 
In  view  of  the  fact  that  VBL  had  a  dominant  position  on  the  relevant  market  for 
supplementary  public  service  pensions  with  market  share  of  37  percent,  taking  into 
account  that  the  Federal  Government  and  most  of  the  Lander  are  involved  by  way  of  a 
collective  agreement,  VBL  would  still  have  been  considered  to  have  a  dominant 
position  in  the  market  even  though  it  has  competitors.726  Instead,  the  Federal  Court  of 
Justice  has  ruled  that  it  is  sufficient  for  a  condition  which  makes  it  more  difficult  to 
terminate  a  long-term  relationship  with  a  dominant  undertaking  to  involve  the  risk  of 
further  strengthening  market  power  by  creating  an  additional  barrier  to  market  entry. 
Accordingly,  it  is  not  necessary  in  the  present  case  to  review  the  clauses  on  the  basis 
of  a  historical,  geographic  or  cross-service  comparison.727 

875  A  "normative-causal"  connection  in  this  respect  between  the  norm  addressee  status 
and  the  infringement  and  the  consequences  of  this  infringement  is  therefore  sufficient 
pursuant  to  the  above-mentioned  principles.  Any  such  connection  is  to  the  detriment  of 
private  users  considering  there  is  a  legal  connection  in  the  form  of  normative  causality 
between  antitrust  law  and  data  protection  assessments  (see  (1)  below).  Unlawful  data 
processing  also  has  the  potential  effect  of  obstructing  competitors  through  the  risk  of 
transferring  market  power  (see  (2). 

(1)  Normative-causal  connection  with  infringement  of  data  protection  law 

876  First  of  all,  there  is  a  normative-causal  connection  in  the  vertical  relationship  with 
private  users  between  the  existence  of  a  dominant  position  in  the  market  and  the 
violation  of  the  relevant  assessments  under  data  protection  law.  In  this  particular  case, 
the  infringement  of  data  protection  rules  exists  given  that  the  restriction  of  private  users’ 


724  OLG  Dusseldorf,  judgment  of  12  July  2017,  “Kabeleinspeiseentgelte“,  para.  131  (iuris);  Frankfurt  Higher 
Regional  Court,  Gotting  in  Loewenheim/Meessen/Riesenkampf,  vol.  2,  GWB,  Section  19,  para.  61 ;  Bechthold, 
GWB,  8th  edition,  Section  19,  para.  5;  Wiedemann,  Handbuch  des  Kartellrechts,  3rd  edition,  Section  23,  para. 
55. 

725  Federal  Court  of  Justice,  decision  of  24  January  2017,  “VBL-Gegenwert  1 1“,  file  ref.  KZR  47/14  (juris). 

726  Federal  Court  of  Justice,  decision  of  24  January  2017,  “VBL-Gegenwert  ll“,  file  ref.  KZR  47/14  (juris). 
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right  to  self-determination  is  clearly  linked  to  Facebook's  dominant  position  in  the 
market. 

877  For  a  start,  this  applies  to  the  lack  of  voluntary  consent.  Recital  43  of  the  GDPR  says 
that  in  order  to  ensure  that  consent  is  freely  given,  consent  should  not  provide  a  valid 
legal  ground  for  the  processing  of  personal  data  in  a  specific  case  where  there  is  a 
“clear  imbalance”  between  the  data  subject  and  the  controller.  Furthermore,  according 
to  Recitals  42  and  43  of  the  GDPR,  it  should  only  be  presumed  that  data  subjects  have 
given  their  consent  voluntarily  if  they  have  a  genuine  or  free  choice  or  are  able  to  refuse 
or  withdraw  consent  without  detriment.  In  any  event,  the  very  fact  that  the  company 
has  a  dominant  position  in  the  market  means  consent  is  not  given  voluntarily.728 

878  Furthermore,  the  market-dominating  position  also  plays  a  role  in  the  context  of  the  legal 
bases  governing  data  protection  set  forth  in  Article  6(1  b)  GDPR  (in  the  context  of  the 
necessity  for  performance  of  the  contract)  and  Article  6(1  f)  GDPR  (in  the  context  of  the 
balancing  of  interests).  It  means  that  Article  6(1  b)  GDPR  can  be  invoked  in  view  of  the 
monopolistic  position  and  the  fact  that  a  dominant  undertaking  can  dictate  data 
processing  conditions  (of.  above  para.  677).  In  addition,  the  Art.  29  Data  Protection 
Working  Party  emphasises,  as  indicated  above,  that  the  dominant  position  of  the  data 
controller  is  a  key  factor  when  balancing  interests  in  Article  6(1  f)  GDPR  (see  above 
para.  730).729 

879  The  violation  of  data  protection  requirements  established  in  this  case  is  a  manifestation 
of  Facebook's  market  power.  Data  protection  law  considers  corporate  circumstances 
such  as  market  dominance,  the  concrete  purpose  and  the  amount  of  data  processed 
in  its  justifications.  This  means  that  companies  behaving  in  a  similar  way  that  do  not 
have  a  dominant  position  in  the  market  would  need  to  be  assessed  differently. 

880  Therefore,  there  would  be  a  correlation  with  market  power  in  this  particular  case  even 
if  this  was  understood  within  the  meaning  of  strict  causality.  The  violation  of  data 
protection  law  in  this  case  was  only  possible  in  the  first  place  because  other  market 
participants  did  not  have  a  chance  to  behave  in  a  similar  way.  Just  because  other 
Internet  companies  such  as  Yahoo,  Bing  Oracle  or  Google  collect  data  via  interfaces730 
does  not  mean  the  same  conduct  by  Facebook  is  permissible  under  data  protection 
law. 


728  [...] 

729  Article  29  Data  Protection  Working  Party,  Opinion  06/2014  on  the  legitimate  interests  of  the  data  controller 
pursuant  to  Article  7  of  Directive  95/46/EC,  p.  51, 71;  [...] 
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881  In  this  respect,  the  concerns  expressed  by  the  DICE  Consult  expert  in  the  report  "An 
Economic  Analysis  of  the  Role  of  Data  Collection  in  Social  Networks”731  are  not 
relevant.  One  of  the  assumptions  voiced  in  the  expert  opinion  is  that  if  Facebook  were 
to  restrict  the  processing  of  "off-Facebook"  data,  it  would  be  forced  to  compete  less 
effectively  with  its  competitors  by  offering  less  innovative  and  poorer-quality  services, 
especially  vis-a-vis  Google.  One  of  the  reasons  for  this  is  that  Facebook  is  subject  to 
discriminatory  data  protection  requirements  with  regard  to  market  dominance.  In 
addition,  users  would  be  doing  themselves  a  disservice  if  they  refused  to  consent  to 
data  processing  that  certainly  offers  benefits. 

882  To  assume  that  data  protection  law  does  not  take  the  individual  circumstances  of  the 
company,  including  market  dominance,  into  account  and  that  these  aspects  are  only 
introduced  via  antitrust  law,  would  be  to  disregard  the  legal  bases  and  standards  of 
data  protection  as  a  whole,  as  well  as  the  method  of  examining  abusive  business  terms 
developed  by  the  Federal  Court  of  Justice.  It  obviously  assumes  that  the  company's 
market  position  does  not  constitute  an  aspect  of  the  assessment  of  data  protection 
standard  that  needs  to  be  met.  Flowever,  as  stated  above,  this  is  incorrect.  The  data 
protection  standard  phrased  in  the  GDPR  may  certainly  appear  debatable  from  the 
economic  expert's  perspective.  Flowever,  this  does  not  alter  the  fact  that  this  is  the 
applicable  standard  for  defining  the  right  of  informational  self-determination  enshrined 
in  the  constitution,  which  accepts  that  economic  advantages  may  be  restricted  within 
the  framework  of  balancing  of  interests. 

883  It  seems  reasonable  and  appropriate  to  take  a  company's  market  position  into 
consideration  under  data  protection  law.  This  not  only  has  implications  for  the  extent 
and  consequences  of  data  collection.  Above  all,  it  plays  a  key  role  in  deciding  whether 
users  have  options  available  and  can  thus  decide  for  themselves  what  level  of  data 
protection  they  want,  or  whether  they  only  accept  data  processing  because  they  would 
otherwise  be  unable  to  avail  themselves  of  a  particular  service.  The  fact  that  in  the 
latter  case  users  may  not  have  a  free  choice  and  the  ability  to  determine  how  data  is 
processed  is  also  indicated  by  the  studies  in  this  case.  According  to  the  user  survey, 
75%  of  respondents  consider  the  handling  of  data  to  be  an  important  factor  in  their 
choice  of  social  network  (see  above,  para.  427).  If,  on  account  of  the  company's  market 
position,  users  have  no  alternative  but  to  consent  to  their  data  being  processed,  they 
are  unlikely  to  read  the  data  policy  as  they  have  to  give  their  consent  anyway.  Due  to 
the  lack  of  alternatives  and  the  strong  lock-in  effects  (para.  460ff.)  users  are  unlikely  to 
be  able  to  switch  to  another  provider  even  if  they  later  become  dissatisfied  with  how 
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their  data  are  being  used.  This  means  users  have  little  or  no  possibility  of  switching  to 
alternative  providers  in  order  to  avoid  the  dominant  undertaking’s  conduct.732 

884  Finally,  the  present  assessment  of  data  protection  law  and  the  determination  of 
Facebook  as  a  company  that  has  a  dominant  position  in  the  market  says  nothing  about 
whether  and  to  what  extent  other  market-dominating  companies  may  be  violating  data 
protection  laws  on  their  relevant  markets  with  the  individual  data  processing  they  carry 
out.  If  Facebook  claims  that  other  companies  also  exchange  data  within  their  groups733 
or  combine  data  from  third-party  sources  with  their  groups’  own  data734,  this  cannot  be 
used  as  a  benchmark  for  assessing  the  impropriety  of  Facebook’s  conduct:  Contrary 
to  Facebook's  view,  the  behaviour  of  third  parties,  which  may  also  be  violating  data 
protection  law  cannot  be  conventionalised  to  become  the  “established  industrial 
standard"735,  as  this  means  the  wrong-doing  of  others  would  become  the  criterion  that 
condemns  the  norm  addressee.  This  could  lead  to  the  paradoxical  outcome  that 
smaller  competitors  -  similar  to  umbrella  effects  in  cartel  agreements736  -  might  be 
tempted  to  act  in  violation  of  data  protection  law  under  the  "umbrella"  of  the  dominant 
undertaking  and  the  dominant  undertaking  could  then  refer  to  competitors’  conduct  to 
justify  its  own  behaviour. 

(2)  Causality  with  regard  to  impeding  effects  on  competitors 

885  In  addition,  there  is  a  causal  relationship  between  the  unlawful  data  processing 
conditions  and  market  dominance  with  regard  to  the  actual  and  potential  impediment 
effects  to  the  detriment  of  competitors. 

886  With  Internet  platforms  that  are  financed  by  advertising,  such  as  Facebook,  the 
incentive  is  very  high  to  exploit  the  data  processing  scope  in  order  to  ensure  the  market 
success  of  advertising.  Due  to  unlawful  data  processing  conditions  that  give  access  to 
the  user  data  of  potential  advertising  customers  -  such  as  social  plugins,  Facebook 
Login  and  the  interface  for  measurement  and  analytics  products  -  the  risk  of  transferring 
market  power  is  also  particularly  virulent.  The  information  gained  from  this  allows 
Facebook  to  make  attractive  offers  to  third-party  operators  in  the  form  of  targeted 
advertising  tailored  specifically  to  their  users. 

887  As  outlined  in  the  foregoing,  this  also  applies  to  the  processing  of  data  collected  from 
Facebook-owned  services,  in  particular  from  WhatsApp  and  Instagram.  The  de  facto 

732  Langen/Bunte/Nothdurft,  Section  19  GWB,  para.  195 

733 

734  [■] 

735 

736  For  the  phenomenon  of  umbrella  effects,  see  Inderst  et  al.,  "Umbrella  Effects",  WuW  2014,  p.1043  ff. 
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integration  of  services  through  interrelated  functionalities  and  de  facto  shared  user 
accounts  that  data  processing  can  bring  involves  the  risk  of  transferring  market  power 
to  markets  on  which  these  services  operate.  WhatsApp,  for  instance,  already  has  a 
strong  position  in  the  market  for  messenger  services,  which  could  expand  further  if  the 
service  is  further  integrated  with  Facebook.  It  is  important  in  this  respect  that  WhatsApp 
and  Instagram  are  also  characterised  by  direct  network  effects  and  that  data 
processing  for  the  purpose  of  consistent  personalisation  with  the  possibility  of 
standardising  lists  of  friends  and  contacts  makes  it  more  difficult  for  users  to  migrate  to 
other  services,  parts  of  which  are  competing  with  Facebook.  In  this  context,  the 
competition  between  Instagram  and  Snapchat  for  photo  services  is  worth  noting. 
Instagram  has  a  major  advantage  by  standardising  the  "product  experience"  with 
Facebook.com,  making  it  more  difficult  for  users  to  switch  providers. 

888  Moreover,  inappropriate  data  processing  also  leads  to  an  increase  in  barriers  to  market 
entry  for  potential  competitors  in  the  market  for  social  networks.  By  introducing  the 
criterion  of  market  dominance  regarding  access  to  data  relevant  for  competition  in 
Section  18  (3a)  no.  4  GWB,  the  legislator  expressly  acknowledged  that  access  to  data 
relevant  for  competition  can  be  of  paramount  importance  for  market  entry  and  market 
success.  Since  the  collection  and  processing  of  data  is  essential  to  the  business  model 
of  social  networks,  they  are  always  keen  to  collect  as  many  data  as  possible.  This  is 
because  detailed  knowledge  about  users  enables  them  to  target  the  kind  of  advertising 
Facebook  wants  to  offer.  Access  to  data  is  therefore  an  important  market  dominance 
factor  when  assessing  a  company’s  position  in  the  market.  The  competitive  edge 
Facebook  already  has  owing  to  its  excellent  access  to  data  relevant  for  competition  will 
be  further  expanded  by  inappropriate  and  thus  unlawful  processing  of  data  from  other 
sources  assigned  to  Facebook  user  accounts,  thereby  further  raising  the  existing 
barriers  to  market  entry  as  a  result  of  direct  network  effects.  In  this  respect,  too,  there 
is  a  direct  correlation  between  the  actual  effect  of  the  Terms  of  Service  and  market 
power.737  Competitors  who  have  lawfully  handled  the  collection  and  processing  of 
personal  data  in  the  past  are  therefore  at  a  competitive  disadvantage  vis-a-vis 
Facebook.738 


737  Weichert  said  this  in  "Violations  of  Data  Protection  Law  as  a  Business  Model  -  the  Case  of  Facebook” 
(DatenschutzverstoR  als  Geschaftsmodell  -  der  Fall  Facebook),  DuD  2012,  71 6ff.  listing  Facebook's  data 
protection  violations  and  claiming  that  acquisition  of  personal  data  which  contravenes  data  protection  law  gives 
Facebook  an  inadmissible  competitive  edge  over  competitors  who  behave  in  a  legally  compliant  manner. 

738  [■■■] 
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b.  Balancing  of  interests  under  antitrust  law 

889  If  terms  of  business  violate  data  protection  values  as  a  result  of  market  power,  the 
comprehensive  balancing  of  interests  required  within  the  framework  of  control  of 
abusive  practices,  taking  into  account  the  objective  of  the  German  Competition  Act, 
which  is  to  promote  free  competition,  does  not  have  any  independent  significance  (see 
(1)  according  to  case  law  of  the  Federal  Court  of  Justice  in  the  VBL  proceedings. 
Balancing  interests  under  antitrust  law  as  a  precaution  in  this  particular  case  also  leads 
to  the  same  outcome  as  the  balancing  of  interests  under  data  protection  law  (see  (2) 
above). 

(1)  Necessity  according  to  case  law 

890  The  case  law  of  the  Federal  Court  of  Justice  in  the  proceedings  VBL-Gegenwert  II 
shows  there  is  no  need  to  balance  interests  under  antitrust  law  as  well.  In  this  case, 
the  Federal  Court  of  Justice  ruled  that  legislation  on  general  terms  and  conditions  had 
been  breached  by  contractual  conditions  as  a  manifestation  of  market  power  and  no 
further  balancing  of  interests  was  carried  out.  From  the  point  of  view  of  the  Decision 
Division,  this  is  also  consistent  on  the  basis  of  the  VBL  assessment  concept. 

891  This  follows  first  of  all  from  the  consideration  that  if  a  company  with  a  dominant  position 
in  the  market  has  been  found  to  infringe  legal  provisions,  the  balancing  of  interests 
cannot,  for  legal  reasons,  lead  to  the  conclusion  being  drawn  that  the  undertaking  has 
an  overriding  interest  in  breaching  antitrust  law.  If  an  infringement  is  the  result  of  market 
power  as  outlined  above,  the  abusiveness  can  no  longer  be  called  into  question  by  a 
further  balancing  of  interests. 

892  This  ensues  from  the  examination  concept  itself,  which  for  the  interpretation  of  the 
antitrust  concept  of  the  appropriateness  of  conditions  relies  on  comparable  concepts 
of  appropriateness  defined  in  other  legal  areas  in  similarly  unbalanced  negotiation 
situations  such  as  legislation  on  general  terms  and  conditions  or  data  protection  law. 
The  appropriateness  rules  of  other  legal  areas  are  themselves  the  result  of  a  balancing 
of  interests  with  regard  to  the  necessary  reconciliation  of  interests  in  the  negotiation  of 
terms  and  conditions.  This  becomes  particularly  clear  in  relation  to  the  data  protection 
assessments  used  here  that  are  based,  by  and  large,  on  a  balancing  of  interests  as 
per  Article  6(1  f)  GDPR  for  the  justification  of  the  data  processing  conditions,  also  taking 
into  account  the  data  controller’s  dominant  position  in  the  market. 

893  The  case  law  of  the  Federal  Court  of  Justice  in  the  Pechstein  case  concurs  with  this 
finding.  In  the  proceedings,  the  Federal  Court  of  Justice  did  indeed  focus  primarily  on 
a  balancing  of  interests  which  was  also  deemed  necessary  in  the  context  of  Section 
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19(1)  GWB.739  This  was  preceded,  however,  by  the  fact  that  no  objection  could  be 
raised  against  the  arbitration  clause  to  be  examined  in  this  case  pursuant  to  the 
provisions  set  forth  in  the  Code  of  Civil  Procedure,  which  are  also  intended  to  prevent 
a  party  from  being  placed  at  a  disadvantage.740  The  further  balancing  of  interests  under 
antitrust  law  carried  out  by  the  Federal  Court  of  Justice,  taking  into  account  the 
constitutional  rights  of  both  parties,  served  only  to  clarify  the  question  of  whether  the 
invalidity  of  the  arbitration  clause  could  result  from  the  more  far-reaching  legal 
requirements  that  the  norm  addressees  of  Section  19  GWB  have  to  fulfil  beyond  the 
general  requirements  (of  the  Code  of  Civil  Procedure).  The  decision  in  the  Pechstein 
case  therefore  does  not  prove  it  is  necessary  to  balance  interests  in  a  case  in  which 
the  norm  addressee  is  already  violating  the  regulations  of  the  legal  system  that  also 
apply  to  non-norm  addressees. 

(2)  Balancing  interests  simultaneously  under  antitrust  law  and  data  protection 
law 

894  In  the  present  case,  the  balancing  of  interests  under  antitrust  law  to  be  carried  out 
merely  as  a  precautionary  measure  leads  to  the  same  outcome  as  an  assessment 
under  data  protection  law.  This  is  because  in  view  of  the  unbalanced  negotiation 
position  represented  by  data  protection  law,  the  assessment  must  be  based  on  similar 
balancing  factors,  one  of  which  is  market  dominance. 

895  This  corresponds  to  the  case  law  of  the  Federal  Court  of  Justice  on  antitrust  law  in  the 
Pechstein  case.  According  to  this,  the  fact  that  the  user  did  not  ask  for  individual 
contractual  terms  and  conditions  does  not  initially  preclude  a  self-determined 
conclusion  of  a  contract  as  a  matter  of  principle,  since  the  contractual  agreement  as  a 
whole  can  represent  a  balancing  of  interests  which  also  regularly  involves  relinquishing 
one's  own  positions.  If,  however,  one  of  the  contracting  parties  has  such  a  dominant 
position  that  it  can  actually  impose  contractual  provisions  unilaterally,  this  means 
conditions  are  being  dictated  by  the  other  contracting  party.  This  applies  in  particular  if 
a  monopoly  or  quasi-monopoly  exists.  It  is  precisely  this  circumstance  that  requires  the 
application  of  the  general  clauses  of  civil  law  such  as  Section  19  (1)  GWB  which  must 
bring  about  a  balance  of  interests  while  taking  the  parties’  constitutional  rights  into 
account.741 


739  Federal  Court  of  Justice,  judgment  of  7  June  2016,  KZR  6/15  -  Pechstein,  para.  48  (juris). 

740  loc.  cit.,  para.  23  to  39. 

741  Federal  Court  of  Justice,  judgment  of  7  June  2016,  KZR  6/15  -  Pechstein,  para.  57  (juris). 
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896  The  narrow  interpretation  of  Article  6  (1  b)  GDPR  is  based  on  the  same  idea.  It  cannot 
be  up  to  the  data  controller  alone  to  define  what  is  necessary  for  the  performance  of  a 
contract,  since  this  would  undermine  the  protection  against  third-party  control  and  the 
need  to  weigh  up  interests.  Also  the  balancing  of  interests  required  pursuant  to  Article 
6(1  f)  GDPR  is  being  consistently  implemented,  taking  all  the  relevant  organisations 
involved,  the  data  subjects  and  third  parties  into  account  on  the  basis  of  principles 
governing  data  protection  law.  The  relevant  aspects  are  also  of  paramount  importance 
when  balancing  interests  solely  under  antitrust  law. 

897  This  applies  first  of  all  to  the  fact  that  the  comprehensive  collection  and  allocation  of 
user  data  from  Facebook-owned  services  and  Facebook  Business  Tools  and  their  use 
outlined  above  are  unnecessary.  It  is  certainly  acknowledged  that  Facebook  has  an 
interest  in  processing  data  to  improve  its  product  and  the  commercial  basis  formed  by 
personalised  advertising.  The  processing  of  data  is  necessary  in  such  "big  data" 
business  models.  Flowever,  this  does  not  mean,  that  scope  of  data  processing  can  be 
freely  determined  by  the  company  and  is  not  subject  to  antitrust  review.  Flowever,  it 
must  be  ensured  that  the  interests  of  the  opposite  market  side  are  sufficiently  taken 
into  consideration  if  a  provider  is  a  dominant  company  that  is  not  subject  to  sufficient 
competitive  control.  This  means  that  the  provider  must  not  place  any  unnecessary 
burdens  on  the  opposite  market  side. 

898  According  to  the  data  protection  assessment,  the  extent  to  which  a  company  that  is 
dominant  in  the  market  can  impose  terms  and  conditions  unilaterally  must  be  taken  into 
account  as  outlined  above.  The  same  applies  to  the  balancing  of  interests  under 
antitrust  law. 

899  On  the  users’  side,  the  data  protection  standard  of  users’  "reasonable  expectation" 
corresponds  to  the  specific  problem  of  market  power  in  relation  to  the  Terms  of  Service 
and  in  particular  the  data  processing  scope.  This  can  be  attributed  to  the  very  fact  that 
users  have  no  overview  of  the  scope  of  the  terms  and  conditions  and  the  extent, 
significance  and  sources  of  data  processing.  The  benchmark  is  therefore  also 
meaningful  for  an  assessment  under  antitrust  law,  taking  the  objective  of  promoting 
free  competition  into  account.  For  the  freedom  of  competition  is  aimed  specifically  at 
giving  the  opposite  market  side  the  opportunity  to  decide  freely  on  the  agreement  of 
contractual  terms. 

900  In  addition,  pursuant  to  the  Pechstein  case  law,  assessments  with  regard  to 
constitutional  rights  have  to  be  included  in  assessments  of  interests  under  competition 
law.742  According  to  this,  it  would  also  be  conceptually  possible  in  the  present  case,  to 

742  Federal  Court  of  Justice,  judgment  of  7  June  2016,  KZR  6/15  -  Pechstein,  para.  55  (juris). 
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determine  the  abuse  directly  by  comprehensively  balancing  interests,  taking  the 
constitutional  rights  of  the  contracting  parties  into  account  with  regard  to  the  exclusion 
of  voluntary  self-determination  as  a  result  of  market  dominance.  In  this  respect,  it  needs 
to  be  considered,  however,  that  the  GDPR  also  makes  a  statutory  decision  on  the 
balancing  of  fundamental  rights,  in  particular  in  the  form  of  justifications  pursuant  to 
Article  6(1)  GDPR.  It  is  basically  assumed  that  this  technical  substantiation  applies  to 
the  antitrust  perspective  in  view  of  the  conflicting  positions  regarding  fundamental 
rights.  In  the  present  case,  this  also  unifies  the  balancing  framework. 

901  Essentially,  therefore,  reference  can  be  made  to  the  assessments  under  data 
protection  law  for  the  balancing  of  interests  under  antitrust  law.  From  the  point  of  view 
of  the  Bundeskartellamt,  the  essential  aspect  in  balancing  of  antitrust  interests  is  the 
significance  of  Facebook's  dominant  position  on  the  market  for  social  networks  for 
continued  use  of  the  internet  by  users  if  they  have  to  accept  the  above-mentioned  data 
processing  conditions  in  order  to  use  of  the  social  network  in  the  first  place. 

902  In  addition,  Facebook's  market  dominance  means  that  unlimited  data  processing  from 
a  variety  of  sources  cannot  be  prevented  simply  by  switching  social  networks.  Users 
would  have  to  refrain  from  using  a  variety  of  services  if  they  did  not  want  to  add  any 
more  data  to  their  extensive  Facebook  database  which  lacks  transparency.  This  would 
greatly  reduce  the  choice  of  internet  services  for  users. 

903  WhatsApp  and  Instagram,  for  example,  are  widely  used  services  with  a  high  user  base, 
which  in  turn  have  direct  network  effects.  As  such,  it  is  questionable  whether  users  will 
be  able  to  do  without  these  services  at  all  in  view  of  the  network  effects  and  the  market 
position  achieved  particularly  by  WhatsApp.  Even  if  this  were  the  case,  it  would 
represent  a  major  and  disproportionate  limitation  of  general  use  of  the  internet  if 
Facebook  users  were  no  longer  able  to  avail  themselves  of  all  other  Facebook  services 
in  order  to  prevent  data  collected  by  these  services  from  being  added  to  the  already 
detailed  user  profile  which  Facebook  has.  What  is  more,  over  [. . .]  of  the  monthly  active 
Facebook.com  users  also  use  WhatsApp  and  in  excess  of  [...]  use  Instagram.743  All 
things  considered,  this  means  that  Facebook.com  users  could  only  prevent  their  data 
from  being  collected  outside  the  social  network  if  they  ceased  using  the  internet  to  a 
large  extent  and  stopped  using  widespread  services  such  as  WhatsApp. 

904  Corporate  efficiency  cannot  be  used  as  an  argument  from  the  antitrust  perspective.  It 
is  true  that  a  common  strategy  within  a  group  to  leverage  potential  internal  synergies 
and  to  develop  efficient  database  structures  can  represent  legitimate  interests. 
Flowever,  a  general  group  privilege  that  would  rule  out  any  such  group  efficiency  by 

743  [..■] 
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consistent  abuse  pursuant  to  Section  19(1)  GWB  does  not  exist  in  antitrust  law  either744 
-  for  instance  in  cases  where  the  provision  of  a  service  is  conditional  on  consent  to 
data  processing.  Contrary  to  Facebook’s  opinion,  no  such  group  privilege  can  be 
derived  from  Section  36  (2)  GWB.  The  protection  interests  of  users  are  predominant 
here  particularly  in  view  of  the  fact  that  it  is  not  apparent  why  the  comprehensive 
combination  of  data  is  necessary. 

905  With  the  social  plugins,  Facebook  Login  and  the  measurement  and  analytics  tools  for 
third-party  providers,  the  aim  of  the  German  Competition  Act  to  promote  freedom  of 
competition  implies  that  users  have  an  overriding  interest  in  controlling  their  data  from 
these  sources.  Users  would  basically  have  to  stop  using  the  internet  given  the  millions 
of  integrated  social  plugins,  Facebook  Logins  and  other  interfaces  that  exist  in 
Germany  which  users  are  unaware  of  before  they  call  up  the  website  and  which  are 
not  visible. in  many  cases.  When  using  third-party  services,  users  are  thus  forced  to 
hand  over  data  beyond  the  social  network  and  Facebook-owned  services  which  is  then 
assigned  to  their  Facebook  user  account.  This  constitutes  an  abusive  enforcement  of 
further  access  to  data  collected  from  third-party  services,  also  by  antitrust  standards. 

906  Finally,  contrary  to  Facebook's  view745,  the  lack  of  an  economic  quantification  of  the 
abusive  conduct  based  on  a  comparison  between  the  resulting  net  consumer  benefit 
and  the  harm  to  consumers  in  order  to  prove  that  the  consumer  benefit  decreases  as 
a  result  of  the  conduct  at  issue  cannot  be  used  as  a  justification. 

907  Facebook  submitted  an  economic  private  opinion  by  Professor  Evans746  to  this  end, 
which  comes  to  the  conclusion  on  the  basis  of  rough  calculations  drawn  up  as  an 
example  that  Facebook  as  a  whole  offers  a  net  benefit  to  German  consumers  and  that 
here  is  no  evidence  of  harm  to  users.  The  expert  opinion  suggests  the  following 
approximate  measurements  [...] 

908  Apart  from  the  fact  that  the  expert  opinion  does  not  make  any  distinction  between  an 
examination  of  data  from  Facebook-owned  services  and  Facebook  Business  Tools  on 
the  one  hand  and  the  data  collected  through  use  of  the  social  network  Facebook.com 
itself  on  the  other,  meaning  that  at  best  it  relates  indirectly  to  the  subject  matter  of  the 
proceedings,  an  economic  quantification  of  abusive  behaviour  hardly  seems 
possible.747 


744  Cross-subsidisation  of  products  within  the  group  is,  for  instance,  subject  to  abuse  control,  of.  e.g.  for  European 
law  Langen/Bunte,  Europaisches  Kartellrecht,  12th  edition,  Article  102  TFEU,  para.  315 

745  [■■■] 

746 

747  [■■■] 
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909  Contrary  to  the  premise  of  the  expert  opinion,  it  can  be  assumed  that  the  conduct 
contested  can  also  lead  to  potential  user  harm  in  economic  terms.  Even  the  collection 
of  data  itself  can  lead  to  behavioural  changes  among  users,  for  instance,  to  avoid 
adverse  reaction  among  friends  or  public  bodies.748  In  addition,  the  extensive  transfer 
of  Facebook  users'  personal  data  by  the  Facebook  Group  to  Cambridge  Analytica749 
and  various  smartphone  manufacturers750  shows  that  from  the  users'  perspective 
unwanted  data  flows  even  on  Facebook  do  not  merely  pose  risks  in  theory. 

910  Users  might  potentially  suffer  material  (financial)  harm  if  Facebook  discloses  data  to 
third  parties,  whether  intentionally  or  unintentionally,  for  instance,  leading  to  identity 
theft,  extortion  or  fraud.  Users  might  also  suffer  non-material  damage.  The  collection 
of  data  may  reveal  information  which  the  user  considers  worthy  of  protection  and  which 
is  not  provided  voluntarily  such  as  income,  location,  diseases,  political  views  or  sexual 
orientation.751  The  potential  for  damage  increases  with  the  scope  and  quality  of  the 
data,  if  Facebook  data  from  Facebook-owned  services  or  Facebook  Business  Tools 
allow  conclusions  to  be  drawn  about  the  history  of  sensitive  websites  accessed  by 
users.  Due  to  the  particular  depth  of  detail  of  the  data,  from  the  user's  point  of  view  this 
involves  a  data  pool  with  particularly  high  damage  potential. 

91 1  In  this  context,  scientists  point  out  that  any  negative  external  effects  of  data  collection 
are  to  the  detriment  of  users.  While  more  extensive  data  collection  offers  the  company 
collecting  the  data  increased  monetisation  potential,  users  bear  the  bulk  of  the  potential 
financial  (and  intangible)  costs  incurred.  This  creates  a  false  incentive  for  the 
companies  collecting  the  data,  which  harvest  "too  much"  data  from  the  consumer 
welfare  point  of  view.752 

912  Nonetheless,  it  is  difficult  to  quantify  the  effects  of  the  damage,  since  it  is  not  clear 
whether,  when  and  how  potential  material  or,  in  particular,  immaterial  consumer 
damage  will  occur  and  which  users  will  be  affected.  It  is  not  possible  to  predict  either 
what  damage  potential  the  data  may  have  as  a  result  of  possibilities  for  combination  or 


748  cf.  Marthews,  A.,  Tucker,  C.  (2017).  Government  Surveillance  and  Internet  Search  Behaviour.  Accessible  at 
httpV/dx.doi.orq/l  0.21 39/ssrn.241 2564  (last  accessed  on  1 0  January  201 9). 

749  cf.  New  York  Times  of  4  April  2018,  “Facebook  Says  Cambridge  Analytica  Harvested  Data  of  Up  to  87  Million 
users”,  accessible  at  https://www.nvtimes.com/2018/04/04/technoloqy/mark-zuckerberq-testifv-  conqress.html 
(last  accessed  on  10  January  2019). 

750  cf.  New  York  Times  of  3  June  2018,  “Facebook  Gave  Device  Makers  Deep  Access  to  Data  on  users  and 
Friends”,  https://www.nvtimes.com/interactive/2018/06/03/technoloqv/facebook-device-partners-users-friends- 

data.html  (last  accessed  on  1 0  January  201 9). 

751  cf.  Jin,  G.,  “Artificial  Intelligence  and  Consumer  Privacy”  in:  Agrawal  A.,  Gans,  J,  Goldfarb,  A.  (publisher),  The 
Economics  of  Artificial  Intelligence:  An  Agenda,  Chicago:  University  of  Chicago  Press,  2018,  accessible  at 
https://www.nber.org/chapters/c14034.pdf  (last  accessed  on  1 0  January  201 9). 

752  cf.  Jin,  G.,  “Artificial  Intelligence  and  Consumer  Privacy”  in:  Agrawal  A.,  Gans,  J,  Goldfarb,  A.  (publisher),  The 
Economics  of  Artificial  Intelligence:  An  Agenda,  Chicago:  University  of  Chicago  Press,  2018, 
https://www.nber.org/chapters/c1 4034.pdf  (last  accessed  on  1 0  January  201 9). 
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technical  analysis  that  may  not  be  available  currently  but  could  well  be  in  the  future.753 
This  also  concurs  with  the  assessments  of  the  Article  29  Data  Protection  Working  Party, 
which  refer  to  justification  pursuant  to  Article  6(1  f)  GDPR  not  just  to  take  into  account 
the  actual  disadvantages  of  data  processing  for  data  subjects,  but  also,  for  the  same 
reasons,  the  potential  risks  of  data  processing  (see  above  para.  767). 

913  Above  all,  however,  the  balanced  consideration  of  welfare  effects  within  the  framework 
of  the  balancing  of  interests  under  antitrust  law  must  be  countered  by  the  fact  that  the 
breach  of  legal  protection  provisions  which  are  intended  to  benefit  users  cannot  be 
justified.  The  provisions  set  forth  in  data  protection  law  provide  users  not  with  mere 
economic  assets  but  with  fundamental  rights  of  freedom  which  personal  data  they  are 
willing  to  disclose.  If  this  personal  responsibility  is  not  guaranteed  as  a  result  of  a 
dominant  company’s  conduct,  this  company  should  not  claim  that  the  loss  of  personal 
responsibility  (from  its  own  perspective)  is  offset  by  the  benefit  of  its  own  performance, 
making  it  acceptable. 

III.  Abuse  pursuant  to  Article  Art.  102  TFEU 

914  Pursuant  to  Article  3  para.  1  sentence  2  of  Regulation  1/2003,  where  the  competition 
authorities  of  the  Member  States  or  national  courts  apply  national  competition  law  to 
any  abuse  prohibited  by  Article  102  of  the  TFEU,  they  shall  also  apply  Article  102  of 
the  Treaty.  According  to  the  catalogue  of  facts  set  forth  in  Article  102  sentence  2  lit.  a 
TFEU,  any  abuse  may  consist  in  directly  or  indirectly  imposing  unfair  purchase  or 
selling  prices  or  other  unfair  trading  conditions.  Plowever,  the  examination  has  shown 
that  the  concept  of  protection  developed  by  German  case  law  on  the  general  clause  of 
Section  19(1)  GWB,  which  relies  heavily  on  decisions  about  values  based  on  both 
fundamental  rights  and  ordinary  law  in  order  to  determine  abusive  conduct,  has  so  far 
found  no  equivalent  in  European  case  law  or  application  practice.  The  intended 
prohibition  is  therefore  based  on  Section  19(1)  GWB  in  conjunction  with  the  relevant 
domestic  case  law.  Pursuant  to  Article  3(2)  sentence  2  of  Regulation  1/2003,  the 
Member  States  are  not  precluded  from  adopting  or  applying  stricter  national  provisions 
in  their  territory  in  order  to  prevent  or  punish  unilateral  actions  by  undertakings.754 


753  cf.  Tucker,  C.,  “Privacy,  Algorithms,  and  Artificial  Intelligence"  in:  Agrawal  A.,  Gans,  J,  Goldfarb,  A.  (publisher), 
The  Economics  of  Artificial  Intelligence:  An  Agenda,  Chicago:  University  of  Chicago  Press,  2018, 
https://www.nber.org/chapters/c1401 1  .pdf  (last  accessed  on  1 0  January  201 9). 

754  cf.  Federal  Court  of  Justice,  judgment  of  6  November  2013,  “VBL-Gegenwert“,  KZR  58/1 1  para.  76  (juris). 
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C.  Decision  based  on  Section  32  of  the  German  Competition  Act 

915  The  decision  is  lawful  on  the  basis  of  Section  32  GWB.  The  main  statements  made  in 
Paragraphs  1  to  4  in  the  operative  part  of  the  decision  relate  to  the  infringing  conduct 
and  the  elimination  thereof  (see  I.).  They  are  necessary  and  proportionate  in  their 
scope,  taking  into  account  the  ancillary  decisions  under  Paragraph  5  to  7  (see  II).  The 
decision  also  corresponds  in  all  other  respects  to  the  dutiful  exercise  of  discretion  (see 
III.). 

I.  Main  statements 

916  The  operative  part  of  the  decision  contains  in  the  basic  structure  of  the  main  statements 
the  prohibition  of  the  use  of  certain  contractual  Terms  of  Service,  explained  by  the 
documents  currently  used  by  the  parties  (Paragraph  1 ,  see  1 ),  and  their  implementation 
by  the  actual  data  processing  (Paragraph  2,  see  2),  as  well  as  the  obligation  to 
designate  and  implement  the  concrete  remedial  measures  required  to  terminate  the 
abusive  conduct  (Paragraph  3,  see  3).  Paragraph  4  relating  to  paragraphs  1-3  clearly 
states  that  the  provision  of  the  service  must  not  be  conditional  on  consent  to  data 
processing. 

1.  Prohibition  of  the  use  of  provisions  in  the  Terms  of  Service  specified  by 
Paragraph  1  in  the  Data  Policy  and  Cookies  Policy 

917  For  a  start,  Paragraph  1  prohibits  the  use  of  Terms  of  Service,  including  their 
specification  in  data  and  cookies  policies,  which  users  must  agree  to  before  they  can 
begin  using  the  service  and  which  document  the  intended  contractual  content.755  First 
of  all,  the  abusive  behaviour  is  described  in  variants  a)  to  c)  (see  a.)  and  is  further 
explained  with  the  current  wording  of  the  Facebook  Terms  of  Service  and  Data  Policy 
in  the  following  indents  (see  b.). 

a.  Terms  of  Service  an  act  of  infringement 

918  Abusive  conduct  consists  essentially  in  the  use  and  implementation  of  terms  of  use 
specified  by  guidelines  vis-a-vis  a  particular  group  of  users  ("private  users"),  the 
provisions  of  which  define  certain  categories  of  data  processing  ("collection", 
combining",  "use")  with  regard  to  certain  types  of  data  ("user  and  device-related  data") 
from  certain  sources  outside  the  Facebook.com  service  (Facebook-owned  services 
and  Facebook  Business  Tools)  and  thus  results  in  the  combination  of  largely  unlimited 


755  cf.  item  5  of  Facebook  Terms  of  Service,  according  to  which  the  Terms  of  Service  constitute  the  entire 
agreement. 
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personal  data  from  the  above-mentioned  sources  and  their  use,  in  particular  the 
combined  use  by  the  Facebook.com  operating  company. 

919  With  the  reference  made  in  Paragraph  1  of  the  operative  part  of  the  decision  to  the 
Terms  of  Service  "including  the  specification  in  the  Data  Policy,  Cookies  Policy  or 
similar  contractual  terms",  the  Bundeskartellamt  has  taken  into  account  the  current 
practice  that  the  Terms  of  Service  contain  only  a  broad  general  provision  governing  the 
processing  of  personal  data,  and  refers  to  explanations  in  a  range  of  other  documents 
(para.  95).  The  documents  are  usually  referred  to  as  "Data  Policy"  or  "Data  protection 
guidelines",  “Privacy  Policy”  or  the  like.  There  is  no  standard  practice  in  the  internet 
industry  with  regard  to  the  designation  of  these  documents  and  the  distribution  of 
contractual  regulatory  materials  among  them.  In  terms  of  content,  internet  companies 
have  broad  scope  for  distributing  regulations  for  different  types  of  documents  (e.g. 
terms  of  use,  data  policy,  cookies  policy,  FAQs,  licensing  conditions). 

920  There  is  also  wide  scope  for  continuously  changing  such  terms  of  use,  as  online 
business  models  also  distribute  documents  in  electronic  form,  which  provides 
centralised,  rapid  and  straightforward  opportunities  for  amendments.  Last  but  by  no 
means  least,  it  should  be  noted  that  terms  of  use  are  often  intended  to  record  and 
safeguard  certain  behaviours  without  specifying  them  vis-a-vis  the  user  (see  also  b.). 
Paragraph  1  of  the  operative  part  of  the  decision  therefore  covers  "comparable 
contractual  terms"  which  is  meant  to  refer  to  these  above-mentioned  circumstances.  In 
this  respect,  the  prohibition  goes  beyond  the  concrete  current  form  of  infringement  and 
extends  to  all  documents  with  provisions  corresponding  to  Paragraph  1 ,  irrespective  of 
how  they  are  designated  and  which  provisions  or  explanations  are  listed  in  which 
documents.  In  addition,  Paragraph  1  establishes  the  connection  between  the  concrete 
designation  of  the  abusive  conduct  and  the  current  contractual  provisions  intended  to 
cover  and  safeguard  it.  In  this  respect,  the  reference  made  to  the  current  contractual 
provisions  explains  the  prohibition  (see  b.  for  more  details)  without  actually  restricting 
it.  Restricting  the  operative  part  of  the  decision  to  the  concrete  type  of  infringement 
would,  as  outlined  above,  create  considerable  possibilities  for  circumvention. 

921  "Private  users"  are  the  natural  persons  who  use  Facebook.com  with  a  personal  profile 
page  and  a  personal  Facebook  user  account  (para.  21).  It  is  not  relevant  whether  the 
users  also  use  the  personal  profile  page  for  professional  or  commercial  purposes  or 
whether  they  also  operate  a  company  website.  The  term  does  not  cover  use  of  a 
Business  Manager  account  (para.  34,  38).  Users  are  resident  in  Germany  if  they  have 
their  permanent  residence  in  Germany  (Section  7  of  the  German  Civil  Code).  In 
connection  with  the  use  of  services  other  than  Facebook.com,  the  term  "private  user" 
refers  to  any  user  who  is  also  a  private  user  of  the  Facebook.com  service,  i.e.  who 
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operates  a  personal  profile  page.  This  also  includes  cases  in  which  a  user  of  Facebook- 
owned  end  customer  services  and  of  websites  that  have  integrated  Facebook  Business 
Tools  is  not  yet  a  private  user  of  Facebook.com  when  the  data  is  collected  and  stored, 
but  this  data  is  subsequently  combined  with  a  personal  profile  following  registration  with 
Facebook. 

922  The  data  processing  procedures  imposed,  namely  "collection,  "combining"  and  “use" 
describe  data  processing  categories  involving  individual  data  processing  procedures 
and  phases,  each  of  which  is  associated  with  the  receipt,  analysis,  and  usable  storage 
of  data  ("collection"),  the  assignment,  in  various  forms,  to  existing  Facebook  data 
(“combining"),  and  "use"  of  this  data  (see  above  para.  580).  The  Bundeskartellamt  has 
used  these  terms,  some  of  which  have  been  coined  under  data  protection  law,  to 
describe  the  conduct  objectively  and  in  accordance  with  the  principle  of  certainty,  in 
order  to  clearly  reflect  the  essence  of  the  infringing  conduct,  in  particular  with  regard  to 
the  merging  and  combination  of  data.  To  this  end,  it  was  imperative  to  depart  from  the 
often  much  less  clear  nomenclature  of  the  terms  of  use,  which  record  and  safeguard 
the  relevant  procedures  without  giving  the  user  any  details  (see  also  b.).  In  particular, 
the  assignment  of  data  to  Facebook  user  accounts  via  common  identifiers  in  itself  is  to 
be  understood  as  “combination”.  Facebook  claims  it  does  not  create  profiles  within  the 
meaning  of  individual  data  records  which  are  each  expanded  when  additional  data  are 
added.756  Rather,  according  to  the  current  database  structure,  the  individual  data  is 
provided  with  identifiers  such  as  the  Facebook  ID  or  other  unequivocal  characteristics 
that  are  stored  throughout  the  entire  database  and  is,  if  necessary,  retrieved  for  a 
specific  use  during  implementation,  based  on  whatever  task  the  algorithm  is  to  perform. 

923  The  prohibition  also  covers  any  limited  use  of  data  from  the  above-mentioned  sources 
by  the  operating  company  of  Facebook.com,  unless  the  order  -  as  in  the  case  of  data 
collected  from  Instagram  (see  below  for  more  details)  -  expressly  prohibits  “combined 
use”.  Moreover,  the  Bundeskartellamt  did  not  specify  any  specific  uses.  Rather,  the 
collection  and  combination  of  data  is  not  justified  by  any  of  Facebook's  purposes  and 
interests  that  were  not  specified  in  detail  at  the  time  of  the  decision,  thus  ruling  out  an 
ex  officio  restriction.  This  means  the  collection  of  data  including  the  assignment  to 
Facebook  user  accounts  is  already  prohibited,  as  is  the  case  with  regard  to,  but  not 
limited  to,  all  other  uses  which  the  assignment  of  data  might  lead  to.  The  mere  non-use 
of  data  collected  and  assigned  for  specific  purposes,  such  as  profiling  (para.  582)  - 
does  not,  according  to  the  justification  at  the  time  of  the  decision,  lead  to  admissibility 
of  the  collection  and  combination  of  data,  in  particular  with  regard  to  the  necessity  of 
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the  data  processing  subject  to  examination  in  each  case,  without  users’  consent,  unless 
new  facts  are  presented  for  this  purpose  in  the  implementation  proceedings. 

924  The  "operating  company  of  Facebook.com"  is  the  company  owned  by  Facebook,  which 
offers  the  Facebook.com  service  according  to  the  imprint  in  Germany.  This  is  currently 
Facebook  Ireland  Ltd.,  Dublin.  This  dynamic  designation,  which  can  be  determined 
from  the  imprint  in  Germany  in  each  case,  serves  to  ensure  the  order  applies  also  to 
intra-group  restructuring. 

925  The  reference  made  to  "user  and  device-related  data"  highlights  the  fact  that  this  not 
only  involves  information  which,  according  to  its  content,  relates  directly  to  the  person, 
such  as  identity,  interests,  living  conditions,  communication  contents  or  behaviour  of 
the  user  ("user-related  data"),  but  also  technical  data  in  the  broadest  sense,  that  refer 
to  the  terminal  devices  used  by  the  user  as  well  as  software  and  other  contents  stored 
on  them.  This  "device-related  data"  can  indirectly  reveal  information  about  the  user, 
such  as  location-related  information,  physical  movements  which  are  generated  via  the 
positioning  data  or  mobile  device  sensors,  creating  a  user  movement  profile.  In 
addition,  device-related  data  can  be  used  to  uniquely  identify  the  device  itself  and 
assign  it  to  a  specific  user  (para.  570).  Device-related  data  therefore  encompass  all 
information  about  the  properties  of  a  mobile  device  (such  as  screen  size,  other 
elements  of  the  hardware  configuration  such  as  processor  cores)  about  the  software 
on  the  mobile  device  (such  as  information  about  the  operating  system  and  application 
software  installed,  browser  information)  or  information  stored  -  even  briefly  -  on  the 
mobile  device  (e.g.  browser  history,  address  book,  cookies  etc.)  or  data  that  are  emitted 
by  the  mobile  device  (e.g.  information  about  the  type  of  signal  output  such  as  WLAN, 
Bluetooth  etc.). 

926  According  to  Paragraphs  1  .a.  and  b.,  data  sources  are  Facebook-owned  end  customer 
services,  which  Facebook  provides  in  addition  to  Facebook.com.  In  that  regard,  the 
Bundeskartellamt  no  longer  included  the  Onavo  service  in  its  decision  after  it  amended 
its  data  processing  conditions.  In  addition,  a  distinction  had  to  be  made  for  Facebook- 
owned  retail  services  between  the  WhatsApp,  Oculus,  and  Masquerade  services,  on 
the  one  hand,  and  Instagram,  on  the  other.  The  former  services  are  all  offered  by  a 
company  belonging  to  the  Facebook  Group  other  than  Facebook.com  (para.6ff.). 
Instagram  like  Facebook.com,  on  the  other  hand,  is  offered  by  Facebook  Ireland  Ltd. 
This  distinction  was  addressed  by  the  Bundeskartellamt  in  that,  contrary  to  Paragraph 
1  .b.,  Paragraph  1  .a.  is  based  on  the  fact  that  the  operating  company  of  Facebook.com 
also  collects  the  data  categories  concerned  using  an  internal  transfer  process  between 
companies  belonging  to  the  group  that  is  relevant  in  terms  of  data  protection  law.  Data 
processing  procedures  involving  the  transmission  and  receipt  of  data  from  other 
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companies  belonging  to  the  group  are  also  subject  to  justification  (para.  593ff).  In  the 
case  of  Instagram,  there  is  no  such  processing  as  the  data  categories  concerned,  which 
are  collected  by  Facebook  Ireland  Ltd.,  are  also  collected  when  using  Instagram  and 
no  additional  intra-group  reception  process  takes  place.  The  combination  with 
Facebook  data,  on  the  other  hand,  is  covered  by  the  operative  part  of  the  decision.  The 
prohibition  of  the  imposed  use  of  Instagram  data  has  been  limited  to  combined  use, 
since  the  use  of  Instagram  data  is  not  the  subject  matter  of  the  proceedings,  in 
particular  for  the  operation  of  Instagram  by  the  joint  operating  company.  By  contrast, 
the  prohibition  also  applies  to  the  use  of  data  imposed  together  with  the  Facebook  data 
obtained  on  the  basis  of  Facebook's  dominant  position  in  the  market. 

927  Paragraph  1  .c.  relates  to  the  processing  of  data  collected  from  Facebook  Business 
Tools  imposed,  if  it  is  carried  out  via  social  plugins  (para.  56ff.),  Facebook  Login  and 
Account  Kit  (para.  63ff.)  and  via  the  Facebook  pixel  or  Facebook  SDKs  for 
measurement  and  analytics  services  (para.  67ff.).  The  fact  that  Paragraph  1  c)  also 
addresses  the  group’s  own  provider  of  Facebook  Business  Tools  as  the  data 
processing  recipient  of  user  and  device-related  data  ensures  that  organisational 
restructuring  involving  Facebook  Business  Tools  will  not  lead  to  data  collected  from 
third-party  sources  being  combined  with  the  data  collected  and  stored  when 
Facebook.com  is  used.  The  Bundeskartellamt  has  thus  addressed  the  possibility  of 
having  separate  systems757  within  the  framework  of  considerations  to  introduce  a  “clear 
history”  function  although  it  is  not  clear  whether  this  would  involve  separation  in 
organisational  terms. 

928  The  main  statement  of  Paragraph  1  in  all  variants  is  limited  to  the  data  processing 
imposed  “without  the  consent”  of  the  data  subject.  The  Bundeskartellamt  has  therefore 
taken  the  fact  into  consideration  that  the  actual  extent  of  the  data  processing  imposed 
can  only  be  justified  if  users  give  their  consent  voluntarily.  In  addition,  there  is  generally 
no  violation  under  antitrust  or  data  protection  law  if  the  data  processing  is  based  on 
sufficient  self-determination  on  the  part  of  the  user.  This  is  because  the  actual  act  of 
infringement  involves  conditions  that  are  imposed  unilaterally  on  the  opposite  market 
side  and  these  terms  have  also  been  externally  determined  by  a  company  that  has  a 
dominant  position  in  the  market.  Under  the  GDPR,  an  objective  justification  of  data 
processing  is  to  be  examined  in  principle  under  the  aspect  whether  the  data  processing 
is  permissible  without  voluntary  consent  on  the  basis  of  legal  justification,  by  way  of 
exception.  The  right  of  informational  self-determination  does  not  provide  a  basis  for  an 
absolute  prohibition  of  data  processing  even  if  the  data  subjects  have  given  their 
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effective  consent.  The  rulings  submitted  by  the  national  data  protection  authorities  are 
therefore  also  limited  to  the  prohibition  of  certain  data  processing  procedures 
implemented  without  users’  consent. 

929  In  understanding  the  notion  of  consent,  it  should  be  taken  into  account  that  the  consent 
currently  obtained  from  data  subjects  within  the  framework  of  their  privacy  settings  for 
the  limited  use  of  data  collected  from  Facebook  partners  (para.  642ff.)  and  the  blocking 
of  cookies  and  advertising  IDs  (para.  646ff.)  does  not  represent  sufficient  consent.  The 
Bundeskartellamt  also  defines  consent  in  Paragraph  4  as  meaning  that  the  parties 
referred  to  in  Paragraphs  1-3  may  not  make  the  provision  of  the  Facebook.com  service 
conditional  on  the  granting  of  consent.  For  when  the  provision  of  service  is  made 
conditional  on  consent  to  data  processing  as  in  this  particular  case,  there  is  reason  to 
assume  that  consent  is  not  given  voluntarily  particularly  in  view  of  the  fact  that 
Facebook  has  a  dominant  position  in  the  market  (para.  634ff.).  The  Bundeskartellamt 
has  refrained  from  issuing  further  specifications  in  the  current  order  with  regard  to  the 
specific  structure  of  consent  -  for  instance  in  terms  of  special  data  categories.  They 
would  need  to  be  examined  in  separate  proceedings. 

930  It  was  not  an  option  to  impose  an  additional  restriction  on  the  reach  of  Paragraph  l.c. 
to  the  case  in  which  Facebook  acts  as  the  data  controller  pursuant  to  the  GDPR.  This 
would  not  apply  to  effectively  agreed  processing  on  behalf  of  the  controller.  It  is 
sufficiently  clear  from  the  reasons  given  for  the  decision  that  the  prohibited  infringement 
is  based  on  the  data  protection  assessments  and  that  -  in  addition  to  other  prerequisites 
such  as  personal  data  and  data  processing  -  Facebook  must  be  held  accountable.  The 
Bundeskartellamt  did  not  consider  the  agreement  referred  to  as  "processing  on  behalf 
of  the  controller"  to  be  effective  (para.  602ff.). 

b.  Current  conditions  and  guidelines 

931  The  Bundeskartellamt  explains  the  variants  described  in  Paragraphs  1  .a.  to  c.  with  the 
indents  a  to  c  below  based  on  examples  of  the  Terms  of  Service  and  policy  contents 
used  by  the  parties  at  the  time  the  decision  was  taken  in  relation  to  the  processing  of 
data  collected  from  Facebook-owned  services  and  the  Facebook  Business  Tools  that 
is  relevant  in  this  context. 

932  First  of  all,  it  describes  the  current  regulatory  system  in  which  the  parties  use  a  broadly 
formulated  regulation  on  data  processing  in  the  Terms  of  Service  (Paragraph  2  (1)  and 
refer  to  the  Data  Policy  for  further  details,  which  in  turn  refers  to  the  Cookies  Policy. 
The  data  processing  procedures  imposed  by  Facebook  that  are  affected  by  the  decree 
currently  result  exclusively  from  these  policies. 
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933  As  such,  the  first  indent  says  that  the  parties  stipulate  in  the  Data  Policy  that  they  can 
collect  user-  and  device-related  data  from  the  data  sources  mentioned  in  Paragraphs 
1  a.  to  c.,  which  are  designated  "Facebook  Products"  and  "Facebook  partners". 

934  The  facts  outlined  in  the  second  indent  make  it  clear  that  according  to  Facebook's  Data 
Policy,  all  data  collected  can  be  used  and  "combined”  across  all  Facebook  Products. 
This  reflects  the  combination  and  also  combined  use  of  data,  which  the 
Bundeskartellamt  paraphrases  as  "combining"  and  as  part  of  the  "use"  of  data  in 
Paragraph  1 .  It  also  becomes  clear  that  information  about  users'  activities  "on  devices" 
can  also  be  used  and  combined  (cf.  Indents  6.  and  7.  below). 

935  The  third  indent  makes  it  clear  that  according  to  Facebook's  Data  Policy,  all  available 
data  can  be  combined  and  also  used  for  the  company’s  measurement  and  analytics 
services. 

936  The  fourth  indent  says  that,  according  to  the  Data  Policy,  all  the  available  data  -  also 
combined  -  can  be  used  for  the  purposes  specified  therein,  including  for  security  and 
research  purposes. 

937  The  fifth  indent  shows,  albeit  limited  to  the  data  sources  mentioned  in  Paragraph  a. 
("Facebook  Companies"),  that  the  data  collected  and  stored  there  during  use  are 
collected  and  combined  in  accordance  with  Facebook's  Data  Policy.  Flere  it  says  "as 
permitted  by  applicable  law  and  pursuant  to  their  Terms  and  Policies".  The  actual 
implementation  -  in  this  connection  reference  is  made  to  Paragraph  2  -  shows 
Facebook's  understanding  of  legal  permissibility.  A  restriction  on  the  transfer  and  use 
of  data  based  on  an  agreement  with  the  Information  and  Data  Protection  Commissioner 
is  found  only  with  respect  to  the  WhatsApp  service,  which  is  described  in  WhatsApp's 
"FAQs,"  but  not  in  WhatsApp's  Terms  of  Service,  Facebook's  Terms  of  Service,  Data 
Policy  or  Cookies  Policy  (para.  122). 

938  The  sixth  indent  indicates  that  according  to  the  Cookies  Policy,  user  and  device-related 
data  can  be  collected  from  the  data  sources  mentioned  in  Paragraph  1  ("Facebook 
Products",  "Facebook  Companies")  and,  in  the  case  of  the  Facebook  Business  Tools, 
this  takes  place  without  any  action  on  the  part  of  the  user.  This  also  shows  that  with 
the  social  plugins  as  well  as  Facebook  Login  and  Account  Kit  a  data  flow  also  occurs 
even  if  the  user  does  not  press  the  corresponding  buttons  on  the  website  or  app  in 
which  they  are  embedded  (para.  144). 

939  The  seventh  indent  indicates  that  under  the  Cookies  Policy,  data  collection  is  not  limited 
to  reading  cookie  data,  but  that  it  includes  device-related  information,  including  the 
software  used  and  user  activity  on  users’  own  devices  off  Facebook.com.  This  shows 
that  it  is  also  possible  to  track  users  without  setting  a  cookie  via  the  other  device 
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identifiers  (see  para.  1 55)  and  that  the  T erms  of  Service  permit  identification  of  the  user 
and  matching  with  existing  data  via  browser  or  device  fingerprinting  para.  570). 

2.  Prohibition  of  the  implementation  of  the  Terms  of  Service,  Paragraph  2 

940  Paragraph  2  prohibits  the  actual  implementation  of  the  Terms  of  Service,  which  at  the 
same  time  shows  the  parties'  understanding  of  their  own  Data  Policies  and  further 
substantiates  the  intended  contractual  contents.  Investigations  show  in  particular  that 
this  concerns  the  specific  data  collected  from  Facebook-owned  services  and  Facebook 
Business  Tools  that  are  linked  in  various  ways  to  Facebook  user  accounts  and  are 
available  for  use. 

941  The  user  data  listed  for  the  individual  services,  which  are  the  subject  of  the 
implementation  of  the  Terms  of  Service,  are  based  on  the  Data  Policies  of  the  services 
and  on  the  answers  of  the  parties  to  the  question  posed  in  the  information  decisions 
regarding  the  data  collected  specifically  from  internal  group  services  and  Facebook 
Business  Tools.  The  list  is  not  exhaustive,  but  serves  as  an  explanation  [...]. 
Facebook’s  claim  that  the  Bundeskartellamt  is  not  taking  actual  data  processing  into 
account  is  incorrect.  The  very  fact  that  Facebook  provides  user  and  device-related  data 
as  examples  clearly  shows  the  wide  scope  of  the  Terms  of  Service  and  Data  Policies. 
In  addition,  the  Bundeskartellamt  determined  in  each  case  how  the  data  is  assigned  to 
the  respective  Facebook  accounts.  In  this  respect,  too,  the  Bundeskartellamt  has 
limited  itself  to  creating  a  list  of  examples,  as  there  are  a  number  of  possibilities 
available  and  the  aim  is  to  record  each  assignment  procedure  in  order  to  avoid 
circumvention. 

942  The  data  listed  in  paragraph  2. a.  for  the  WhatsApp  service  are  derived  from  the  "FAQs" 
provided  by  WhatsApp  (see  para.  123)  and  from  the  investigations  carried  out  at 
Facebook.  According  to  Facebook,  the  data  is  currently  assigned  to  the  respective 
Facebook  user  accounts  via  the  Family  Device  ID  that  WhatsApp  installs  on  the  users' 
devices  (see  para.  125  above).  The  latter  is  reflected  particularly  by  the  placement  of 
cookies  on  the  users'  computer  described  in  the  Cookies  Policy  (above  6th  and  7th 
indent)  including  data  stored  by  Facebook  on  the  users'  web  browser  or  device, 
identifiers  associated  with  the  users'  device,  and  other  software. 

943  The  data  listed  in  Paragraph  2.b.  for  the  Oculus  and  Masquerade  services  are  derived 
from  the  respective  Data  Policies  and  from  the  investigations  at  Facebook.  The  above- 
mentioned  data,  according  to  Facebook,  is  assigned  to  Facebook  user  accounts  either 
via  the  Facebook  Login,  e-mail  addresses  or  device  IDs  (see  above  para.  134ff.). 
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944  The  Instagram  data  listed  in  item  2.c.  are  based  on  Instagram's  Data  Policy  and 
investigations  at  Facebook  (para.  127f.)  According  to  Facebook,  the  data  are  assigned 
via  the  Family  Device  ID. 

945  The  data  listed  in  Paragraph  2.d.  on  Facebook  Business  Tools  are  based  in  particular 
on  Facebook’s  replies  (see  above  para.  144ff.).  According  to  Facebook,  they  represent 
"minimum  data  records"  or  "standard  information"  and  are  therefore  not  exhaustive,  but 
have  merely  been  given  as  examples.  On  the  one  hand,  this  involves  a  large  number 
of  device-related  data  and  device  IDs  as  described  above.  User-related  data  is 
collected  in  particular  via  SDKs  or  the  Facebook  pixel  with  the  so-called  "Events",  which 
relate  to  the  user  interactions  with  the  mobile  app  or  website  and  can  be  configured  in 
a  variety  of  ways  (see  para.  70,  73,  147,  150  above).  The  data  collected  are  assigned 
to  Facebook  accounts  in  various  ways.  It  is  currently  done  via  cookie  data  that  contain 
various  identifiers,  such  as  a  pixel  ID  or  Facebook  ID  (see  above  para.  152),  via  device 
identifiers,  advertising  IDs  and  other  device-related  metadata  (para.  154,  155)  or  via 
hashed  identifying  plain  user  data  within  the  scope  of  so-called  “advanced  matching” 
(para.  153).  Flere,  too,  the  list  of  assignment  procedures  is  by  no  means  exhaustive. 

3.  Obligation  to  terminate  the  infringement,  Paragraph  3 

946  The  Bundeskartellamt  also  requires  the  parties  to  implement  various  measures  to 
terminate  the  antitrust  infringement. 

947  Paragraph  3. a.  contains  an  obligation  to  terminate  the  infringement,  to  remove  and 
amend  the  Terms  of  Service  and  to  implement  them  within  a  period  of  12  months. 

948  Paragraph  3.b.  contains  a  few  specifications  for  the  amendment  of  the  Terms  of 
Service,  including  the  Data  Policies  that  specify  these  terms  of  use,  within  the  same 
period  of  time,  requiring  the  parties  to  expressly  clarify  vis-a-vis  private  users  that  user- 
related  data  from  the  sources  concerned  will  not  be  collected,  combined  or  used  without 
their  consent.  The  Bundeskartellamt  hereby  uses  a  common  practice  in  the  privacy 
statements,  which  WhatsApp  also  uses,  for  instance,  in  relation  to  reading  encrypted 
data  or  Onavo.  This  obligation  is  also  based  on  the  justification  available  at  the  time 
the  decisions  were  taken.  Insofar  as  solutions  conforming  to  antitrust  law  are  put 
forward  in  the  implementation  procedure,  the  Bundeskartellamt  will  consider  these  as 
new  facts  and  adjust  the  clarification  obligation  accordingly. 

949  Paragraph  3.c.  finally  contains  the  obligation  to  submit  an  implementation  road  map 
within  4  months  of  the  decision  being  served,  which  describes  and  explains  in  detail 
the  solution  proposals  as  well  as  the  individual  elements  and  steps  involved,  indicating 
the  planned  date  of  implementation.  In  this  respect,  the  Bundeskartellamt  is  responding 
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to  the  parties'  submission  that  the  solution  in  the  previously  envisaged  solution 
scenarios  presents  a  technical  challenge  that  would  take  several  months  to  resolve. 
The  implementation  road  map  must  include  a  detailed  description  of  the  solution,  the 
necessity  thereof  and  the  technical  steps  involved.  This  also  includes  the  press  release 
of  the  parties'  plan  to  integrate  Facebook,  WhatsApp,  and  Instagram  more  closely.758 

II.  Necessity  and  proportionality  according  to  Section  32  of  the  Act  on  Restraints  of 
Competition 

950  The  obligations  to  terminate  the  infringement  are  necessary  and  proportionate  to  the 
extent  outlined  in  the  operative  part  of  the  decision. 

951  In  particular,  the  obligations  were  not  to  be  limited  to  an  acceptable  level  of  data  or 
categories  of  data,  taking  into  account  the  different  data  uses  listed  by  the  parties.  Nor 
can  they  be  limited  to  individual  data  processing  procedures  -  for  example,  use  of  data 
only  for  certain  purposes.  This  is  because  the  Terms  of  Service  and  the  policies 
specifying  them  refer  to  all  the  information  about  the  user  and  device-related  data  the 
parties  collect  from  the  above-mentioned  sources  and  that  can  be  collected,  combined 
and  used  without  restriction  for  all  the  of  the  above-mentioned  purposes.  However, 
such  comprehensive  data  processing  can  only  be  justified  if  users  give  their  consent 
voluntarily. 

952  In  addition,  it  had  to  be  taken  into  account  that  at  the  time  the  decision  was  taken  the 
parties  had  not  provided  sufficiently  objective  justifications  for  any  of  the  data 
processing  procedures  imposed  for  all  of  the  user-  and  device-related  data  at  issue 
here  and  the  explanations  they  put  forward  had  no  objective  justification.  It  was  not 
substantiated  either  what  data  is  necessary  for  what  purposes  or  what  the  purposes 
specifically  involve.  Facebook's  statement  is  limited  to  claiming  that  all  data  are 
necessary  for  all  purposes  from  all  data  sources  at  issue  here,  in  particular  for  the 
personalisation  of  the  service  and  advertising.  Since  according  to  the  case  law  of  the 
European  Court  of  Justice  objective  justification  is  required  for  all  data  processing 
procedures  -  as  the  parties  themselves  argue  -  the  parties  who  are  subject  to  the 
burden  of  proof,  at  least  in  terms  of  explanation  and  data  protection  law,  did  not  have 
objective  justifications  available  at  the  time  of  the  decision.  This  means  the  data 
processing  at  issue  here  infringes  the  prohibition  of  abusive  practices  with  regard  to  all 
user-  and  device-related  data  in  the  data  processing  categories  described,  irrespective 
of  the  purposes  mentioned,  taking  into  account  the  data  protection  assessments.  In 
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order  to  terminate  the  infringement,  the  extent  imposed  in  the  prohibition  is  therefore 
necessary  -  limited  to  the  lack  of  consent. 

953  The  open  obligation  to  terminate  the  infringement,  to  amend  the  Terms  of  Service  set 
out  in  Paragraph  3. a.  and  to  implement  them  under  Paragraph  3.b.  and  c.  that  extend 
beyond  the  obligation  to  amend  the  Terms  of  Service  are  also  necessary  for  the 
effective  termination  of  the  infringement  and  are  permissible  under  Section  32(2)  GWB. 

954  It  would  not  be  sufficient  for  effective  termination  of  the  infringement  on  the  one  hand 
or  proportionate  on  the  other  to  merely  prohibit  implementation.  The  open  wording  is 
necessary  because  the  parties  involved  can  choose  at  their  own  entrepreneurial 
discretion  the  remedy  to  terminate  the  infringement  that  conforms  to  antitrust  law.  The 
antitrust  authority  is  unable  and  is  not  permitted  to  impose  a  specific  solution.  The  order 
is  therefore  limited  to  specifying  an  implementation  period  of  1 2  months  for  termination 
of  the  infringement.  The  timeframe  of  12  months  takes  the  parties'  statement  into 
consideration  that  the  technical  challenge  could  take  several  months  to  complete.759 

955  The  obligation  to  clarify  the  issues  according  to  Paragraph  3.b  ensures  that  the 
restriction  of  data  processing  from  sources  outside  Facebook.com  will  be  made 
sufficiently  transparent  vis-a-vis  users  and  that  a  clear,  binding  and  enforceable 
agreement  will  be  reached  with  the  user  in  this  respect.  The  decision  is  necessary  and 
appropriate  as  a  means  of  eliminating  the  consequences,  especially  since  the  users 
concerned  are  private  individuals  who  would  otherwise  continue  to  be  affected  by  the 
old  Terms  of  Service  to  an  even  greater  extent.  Here,  too,  the  Bundeskartellamt 
considers  it  necessary  to  take  into  account  a  consent  solution  with  the  requirements 
set  out  in  Paragraph  4,  as  it  does  for  Paragraph  1.  If  the  parties  involved  in  the 
proceedings  implement  further  solutions  that  comply  with  antitrust  law  and  submit 
objective  justifications,  in  advance  and  in  detail,  the  Bundeskartellamt  will  take  this  into 
account  as  a  new  fact. 

956  Furthermore,  with  regard  to  possible  solutions  that  comply  with  antitrust  law,  it  is 
necessary  and  proportionate  for  the  effective  termination  of  the  infringement  to  oblige 
the  parties  involved  in  Paragraph  3.c  to  submit  an  implementation  road  map  as  an  initial 
step  within  the  overall  implementation  period,  which  describes  and  explains  in  detail 
the  solution  proposals  as  well  as  the  individual  elements,  steps  and  timeline  involved. 
This  is  also  necessary  in  order  to  be  able  to  take  into  account  the  changed 
circumstances  and/or  to  adjust  deadlines  within  the  scope  of  the  revocation 
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reservation.  The  four-month  deadline  for  this  is  appropriate  and  necessary  in  order  to 
ensure  speedy  and  structured  implementation. 

957  Contrary  to  Facebook's  view,  the  prohibition  and  the  obligation  to  terminate  the 
infringement  to  the  extent  outlined  in  the  operative  part  of  the  decision  are  by  no  means 
disproportionate.  The  extent  to  which  there  is  a  risk  of  fundamental,  irrevocable  and 
entirely  disproportionate  consequences  if  Facebook  has  to  amend  unacceptable  Terms 
of  Service  and  Data  Policies  within  a  reasonable  period  of  time  is  not  evident.  Facebook 
apparently  argued  as  much  in  the  event  that  it  had  been  obliged  to  terminate  the 
infringement  without  any  implementation  deadline.760 

958  The  assumption  made  in  Facebook's  statement  in  response  to  the  statement  of 
objections  that  the  Bundeskartellamt  is  imposing  prohibitions  that  are  disproportionate 
to  the  concerns  expressed  is  incorrect.  Restricting  the  prohibition  or  the  obligation  to 
terminate  the  infringement  to  an  extent  permissible  under  data  protection  law  based  on 
various  parameters  (extent  of  the  data,  type  of  data,  type  of  data  processing,  purpose 
limitation,  anonymisation,  effective  processing  on  behalf  of  the  controller,  user  control 
options,  retention  periods,  protective  measures,  etc.)  is,  as  described  above,  out  of  the 
question  and  would  actually  constitute  an  infringement  of  the  principle  of 
proportionality.  Unlike  quantitative  abusive  pricing,  it  is  inconceivable  to  specify  an 
"abuse  limit"  in  the  case  of  qualitative  abusive  terms  due  to  infringements  of  the  law. 
On  the  contrary,  in  relation  to  Paragraphs  1-3  the  parties  bear  full  responsibility  for  the 
lawfulness  of  their  data  processing  and  thus  also  for  the  termination  of  the  infringement. 
It  is  not  true  either  that  the  Bundeskartellamt  is  prohibiting  “on  Facebook”  data 
processing.  During  the  entire  proceedings,  the  Bundeskartellamt  made  it  clear,  also  in 
the  preliminary  assessment  of  19  December  2017,  that  Facebook-owned  services  are 
deemed  to  be  “third-party  sources”.  Furthermore,  limiting  the  subject-matter  of  the 
proceedings  to  off-Facbook  data  sources  is  a  matter  of  discretion  for  the 
Bundeskartellamt  and  is  not  the  result  of  any  legal  considerations. 

959  Paragraph  5  of  the  operative  part  of  the  decision  allows  the  parties  in  relation  to  1  to  3 
to  apply  for  interim  proceedings  before  they  have  to  start  preparing  to  implement  the 
order.  Once  the  interim  proceedings  have  been  brought  to  a  conclusion  at  a  court  of 
first  instance,  the  parties  still  have  almost  the  entire  implementation  period  of  1 2  months 
provided  for  in  the  order  if  they  file  an  application  for  suspensive  effect  pursuant  to 
Section  65  (3)  sentence  3  GWB  when  they  file  an  appeal  in  the  main  proceedings.  In 
that  regard,  by  giving  two  months'  notice,  the  Bundeskartellamt  has  taken  into  account 
the  statutory  time-limit  for  substantiating  reasons  for  an  appeal  in  the  main 
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proceedings.  Paragraph  5  sentence  2  of  the  operative  part  of  the  decision  covers  all 
cases  of  dismissal  of  the  interim  proceedings  by  the  court  of  first  instance.  If  the  interim 
proceedings  are  terminated  by  a  court  decision  on  the  merits,  the  date  of  that  decision 
shall  be  authoritative.  Where  the  summary  proceedings  are  terminated  by  process 
declarations,  the  date  of  receipt  by  the  court  of  the  process  declaration  bringing  about 
the  termination  will  be  authoritative.  The  reservation  of  complete  or  partial  revocation 
in  Paragraph  7  also  extends  to  Paragraph  5  of  the  operative  part  of  the  decision  and 
allows  the  regulation  to  be  adjusted  if  this  appears  to  be  appropriate  during  the  course 
of  the  interim  proceedings,  in  the  light  of  appreciable  interests  of  the  parties  involved 
or  in  the  public  interest  in  enforcement.  An  adjustment  of  the  provision  is  particularly 
worth  considering  if  preliminary  rulings  pursuant  to  Article  267  para.2  TFEU  are  to  be 
delivered  in  interim  proceedings. 

960  The  Bundeskartellamt  does  not  see  any  need  for  the  antitrust  authorities  to  suspend 
the  order  pursuant  to  Section  65  (3)  sentence  2  GWB  at  this  point  in  time.  The  basic 
issues  raised  by  the  parties  particularly  regarding  the  competency  of  the 
Bundeskartellamt  and  the  basic  issues  of  abusive  business  terms  can  be  sufficiently 
clarified  as  legal  issues  in  advance  within  the  framework  of  interim  proceedings  based 
on  summary  examination.  It  is  not  assumed,  however,  that  this  case  is  a  “pilot  judgment 
procedure”  that  could  be  subject  to  serious  legal  doubts  in  view  of  the  recent  case  law 
of  the  Federal  Court  of  Justice  in  the  VBL  Gegenwert  and  Pechstein  cases. 

961  Paragraph  7  regulates  a  reservation  of  full  or  partial  revocation  that  applies  to  all  rules 
of  the  order.  The  reservation  of  revocation  means  the  decision  can  be  adapted  flexibly 
to  changed  circumstances.  This  includes,  in  particular,  the  taking  into  account  of 
various  solution  possibilities  that  cannot  be  imposed  within  the  framework  of  the 
decision  for  reasons  of  proportionality.  In  addition,  the  possibility  of  adjusting  the 
implementation  deadlines  and  suspending  them,  in  particular  with  regard  to  the 
solutions  proposed  by  Facebook,  adjusting  the  different  time  frames  required  in  each 
case,  as  the  case  may  be,  and  with  regard  to  the  lodging  of  further  legal  remedies,  is 
necessary  and  proportionate.  After  all,  this  allows  for  a  flexible  and  rapid  response  to 
changing  market  conditions  and  innovations  in  Internet  services,  the  technical  and 
commercial  dynamics  of  which  are  unpredictable.  The  Bundeskartellamt  has  therefore 
refrained  from  ordering  a  fixed  period  of  validity  for  the  order. 


III.  Other  discretionary  powers 

962  The  Bundeskartellamt  exercised  its  discretionary  power  by  prohibiting  abusive 
practices  pursuant  to  Section  32  GWB.  The  Bundeskartellamt  thus  considers  it  to  be  in 
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the  public  interest  to  enforce  antitrust  measures  to  terminate  the  infringement  of  data 
protection  law  resulting  from  market  power. 

963  As  such,  in  the  Bundeskartellamt’s  opinion,  the  public  interest  in  carrying  out  an 
antitrust  review  of  Facebook's  data  processing  is  limited  to  the  imposed  collection  of 
personal  user  data  from  Facebook's  own  services  and  Facebook  Business  Tools 
described  above,  together  with  the  assignment  of  these  data  to  respective  Facebook 
user  accounts  and  the  use  of  any  such  data.  These  terms  and  conditions  have 
considerable  reach  since  the  market  power  Facebook  has  by  collecting  data  extends 
beyond  the  social  network,  affecting  consumers’  use  of  the  internet. 

964  The  Bundeskartellamt  also  thinks  there  is  a  limit  to  the  importance  for  consumers  of 
the  efficiencies  of  a  business  model  based  on  personal  data  and  personalised 
advertising  in  respect  of  the  processing  of  data  from  sources  outside  Facebook.com. 
The  provision  of  a  social  network  free  of  charge  that  is  funded  by  advertising  is  also  of 
high  benefit  for  consumers.  Both  the  functionalities  of  a  social  network  and  the  fact  that 
it  is  financed  through  advertising,  in  principle,  imply  a  high  degree  of  processing  of 
personal  data. 

965  Flowever,  the  Bundeskartellamt  holds  that  the  efficiencies  in  a  business  model  based 
on  personalised  advertising  do  not  outweigh  the  interests  of  the  users  when  it  comes 
to  processing  data  from  sources  outside  of  the  social  network.  This  applies  in  particular 
where  users  have  insufficient  control  over  the  processing  of  their  data  and  the 
assignment  of  this  data  to  their  Facebook  user  accounts.  As  far  as  this  part  of  data 
processing  is  concerned,  intervention  from  a  competition  law  perspective  is  appropriate 
from  the  Bundeskartellamt’s  point  of  view  because  the  data  protection  boundaries  set 
forth  in  the  GDPR  were  clearly  overstepped,  also  in  view  of  Facebook’s  dominant 
position. 

966  In  the  present  case,  this  does  not  conflict  with  the  fact  that  data  protection  authorities 
and  consumer  associations  can  also  take  action  against  Facebook's  infringements 
based  on  their  legal  bases.  Rather,  it  makes  sense  for  market  dominance  to  be 
determined  and  established  by  the  Bundeskartellamt  itself  leveraging  its  powers  to 
provide  information  and  within  the  differentiated  framework  of  antitrust  law.  This 
approach  is  welcomed  by  the  Federation  of  German  Consumer  Organisations  (VZBV) 
as  well  as  by  the  data  protection  authorities  761 
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D.  Fees 
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Instruction  on  rights  of  appeal: 

This  decision  is  subject  to  appeal.  The  appeal  should  be  submitted  in  writing  to  the 
Bundeskartellamt,  Kaiser-Friedrich-StraBe  16,  53113  Bonn  within  one  month  upon  service  of 
the  decision.  Receipt  of  the  appeal  by  the  appellate  court,  the  Dusseldorf  Higher  Regional 
Court,  within  this  time  limit  is,  however,  also  sufficient. 

The  reasons  for  the  appeal  should  be  presented  in  a  written  statement  and  submitted  to  the 
Bundeskartellamt  or  the  appellate  court.  The  time  limit  for  filing  the  statement  of  appeal  is  two 
months.  It  shall  begin  upon  receipt  of  the  decision  under  appeal  and  may,  upon  application,  be 
extended  by  the  presiding  judge  of  the  appellate  court.  The  statement  of  appeal  must  state  the 
extent  to  which  the  decision  is  being  appealed  and  its  modification  or  revocation  sought  and 
indicate  the  facts  and  evidence  (if  applicable,  also  new  facts)  on  which  the  appeal  is  based. 

The  notice  of  appeal  and  the  statement  of  the  reasons  of  appeal  must  be  signed  by  a  lawyer. 

The  appeal  has  no  suspensive  effect.  The  appellate  court  may,  upon  application,  entirely  or 
partly  restore  the  suspensive  effect  of  the  appeal. 


Topel 


Judith 


Dr  Sewczyk 
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